CVE-2025-42961

Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient validation of user permissions to access sensitive database tables. By leveraging overly permissive access configurations, unauthorized...

CVE-2025-42954

SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any input parameters, which results in reduced performance or interrupted operation of the affected resource. This leads to low impact on...

CVE-2025-42960

SAP Business Warehouse and SAP BW/4HANA BEx Tools allow an authenticated attacker to gain higher access levels than intended by exploiting improper authorization checks. This could potentially impact data integrity by allowing deletion of user table entries.�It has no impact on the confidentialit...

CVE-2025-31326

SAP�BusinessObjects Business�Intelligence Platform Web Intelligence is vulnerable to HTML Injection, allowing an attacker with basic user privileges to inject malicious code into specific input fields. This could lead to unintended redirects or manipulation of application behavior, such as...

CVE-2025-42986 Missing Authorization check in SAP NetWeaver and ABAP Platform

Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call RFC, potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on...

CVE-2025-42986 Missing Authorization check in SAP NetWeaver and ABAP Platform

Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call RFC, potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on...

CVE-2025-42986

CVE-2025-42986 concerns SAP BASIS with a missing authorization check in an obsolete RFC-enabled function module. The root cause allows an authenticated, low-privilege attacker to invoke a Remote Function Call (RFC) and potentially access restricted system information. The documented impact is lim...

CVE-2025-42985 Open Redirect vulnerability in SAP BusinessObjects Content Administrator workbench

Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a victim�s browser. This could potentially lead to the exposure or modification of web client data, resulting in low impact on confidentiality a...

CVE-2025-42985

CVE-2025-42985 affects SAP BusinessObjects Content Administrator Workbench, where insufficient input sanitization allows crafting malicious URLs that can execute scripts in a victim’s browser. The likely impact is low confidentiality and integrity impact with no availability impact, per the CVE d...

CVE-2025-42985 Open Redirect vulnerability in SAP BusinessObjects Content Administrator workbench

Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a victim�s browser. This could potentially lead to the exposure or modification of web client data, resulting in low impact on confidentiality a...

CVE-2025-42981 Multiple vulnerabilities in SAP NetWeaver Application Server ABAP

Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script at a location not properly sanitized. When a victim clicks on this link, the script executes within the victim's browser, redirecting the...

CVE-2025-42981 Multiple vulnerabilities in SAP NetWeaver Application Server ABAP

Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script at a location not properly sanitized. When a victim clicks on this link, the script executes within the victim's browser, redirecting the...

CVE-2025-42981

CVE-2025-42981 concerns SAP NetWeaver Application Server ABAP. The provided details confirm an open-redirect vulnerability that allows an unauthenticated attacker to craft a URL embedding malicious script. When a victim clicks the link, the script runs in the browser and can redirect to an attack...

CVE-2025-42980

CVE-2025-42980 affects SAP NetWeaver Enterprise Portal Federated Portal Network. The initial and linked sources describe an insecure deserialization vulnerability where a privileged user can upload untrusted or malicious content, which, when deserialized, can compromise confidentiality, integrity...

CVE-2025-42980 Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network

SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

CVE-2025-42980 Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network

SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

CVE-2025-42979 Insecure Key & Secret Management vulnerability in SAP GUI for Windows

The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attacker who gains access to the user hive o...

CVE-2025-42979

The CVE-2025-42979 entry concerns GuiXT, which is integrated with SAP GUI for Windows. The vulnerability stems from using obfuscation algorithms instead of secure symmetric ciphers to store RFC user credentials on the client PC, residing in the Windows user registry hive. This leads to a confiden...

CVE-2025-42979 Insecure Key & Secret Management vulnerability in SAP GUI for Windows

The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attacker who gains access to the user hive o...

CVE-2025-42978

The CVE-2025-42978 entry concerns SAP NetWeaver Application Server Java and a flaw in outbound TLS connections: the component may not reliably compare the remote server’s hostname with the wildcard in the server certificate, potentially causing connections to a malicious TLS server and leading to...