Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3652901 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42899 State: PUBLISHED Published: 2025-11-11T00:20:03.667Z Last Updated: 2025-11-12T20:09:49.885Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP S4CORE (Manage Journal Entries) Problem Types: CWE-862 Description: SAP S4CORE (Manage journal entries) does not perform necessary authorization checks for an authenticated user resulting in escalation of privileges. This has low impact on confidentiality of the application with no impact on integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3530544 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42901 State: PUBLISHED Published: 2025-10-14T00:17:23.355Z Last Updated: 2025-10-14T15:21:26.115Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Application Server for ABAP (BAPI Browser) Problem Types: CWE-94 Description: SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affected functionality of BAPI explorer. This has low impact on confidentiality and integrity with no impact on availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/not
availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3652788 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42902 State: PUBLISHED Published: 2025-10-14T00:17:32.898Z Last Updated: 2025-10-14T15:22:05.634Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SAP_SE Products: SAP Netweaver AS ABAP and ABAP Platform Problem Types: CWE-476 Description: Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket to the SAP application server. This leads to a dereference of NULL which makes the work process crash. As a result, it has a low impact on the availability but no impact on the confidentiality and integrity. Additional Analyst Notes:
t, it has a low impact on the availability but no impact on the confidentiality and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3627308 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42903 State: PUBLISHED Published: 2025-10-14T00:17:39.686Z Last Updated: 2025-10-14T15:22:42.641Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Financial Service Claims Management Problem Types: CWE-204 Description: A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of personal data through response discrepancies, causing low impact on confidentiality with no impact on integrity or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3656781 - https://url.sap/sapsecurity
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3656781 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42906 State: PUBLISHED Published: 2025-10-14T00:17:48.076Z Last Updated: 2025-10-14T15:23:19.287Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Commerce Cloud Problem Types: CWE-22 Description: SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not explicitly deployed. This could potentially bypass configured access restrictions, resulting in a low impact on confidentiality, with no impact on the integrity or availability of the application. Additional Analyst Notes: - CISA ADP V
fidentiality, with no impact on the integrity or availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3634724 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42907 State: PUBLISHED Published: 2025-09-23T01:58:28.486Z Last Updated: 2025-10-14T00:17:56.274Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP BI Platform Problem Types: CWE-918 Description: SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3540622 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42908 State: PUBLISHED Published: 2025-10-14T00:18:04.097Z Last Updated: 2025-10-14T15:23:56.508Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server for ABAP Problem Types: CWE-352 Description: Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allow the attacker to perform actions and execute transactions that would normally require specific permissions,
could allow the attacker to perform actions and execute transactions that would normally require specific permissions, compromising the integrity and confidentiality of the system by enabling unauthorized access to restricted functionality. There is no impact to availability from this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3642021 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42909 State: PUBLISHED Published: 2025-10-14T00:18:11.957Z Last Updated: 2025-10-14T15:24:17.575Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Cloud Appliance Library Appliances Problem Types: CWE-1004 Description: SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in an existing SAP CAL appliances to gain access to other appliances. This has low impact on confidentiality of the application, integrity and availability is not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3643871 - https:/
ot impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3643871 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42910 State: PUBLISHED Published: 2025-10-14T00:18:21.887Z Last Updated: 2025-10-21T03:55:25.261Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Supplier Relationship Management Problem Types: CWE-434 Description: Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application. Additional Analyst
n attacker could cause high impact on confidentiality, integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3647332 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42911 State: PUBLISHED Published: 2025-09-09T02:05:56.778Z Last Updated: 2025-09-09T13:51:38.627Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver (Service Data Download) Problem Types: CWE-862 Description: SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operating system. This leads to a low impact on confidentiality, with no effect on the integrity and availability of the application Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3627644 - https:/
application Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3627644 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42912 State: PUBLISHED Published: 2025-09-09T02:06:08.163Z Last Updated: 2025-09-10T03:56:05.838Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: SAP_SE Products: SAP HCM (My Timesheet Fiori 2.0 application) Problem Types: CWE-862 Description: SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a significant impact on the application's integrity, while confidentiality and availability remain unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3635587 - https://url.sap/sapsec
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3635587 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42913 State: PUBLISHED Published: 2025-09-09T02:06:16.378Z Last Updated: 2025-09-10T03:56:07.525Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP HCM (My Timesheet Fiori 2.0 application) Problem Types: CWE-862 Description: Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform activities that are otherwise restricted, resulting in a low impact on the integrity of the application. Confidentiality and availability are not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
identiality and availability are not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3635587 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42914 State: PUBLISHED Published: 2025-09-09T02:06:24.347Z Last Updated: 2025-09-10T03:56:08.411Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP HCM (My Timesheet Fiori 2.0 application) Problem Types: CWE-862 Description: Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform activities that are otherwise restricted, resulting in a low impact on the integrity of the application. Confidentiality and availability are not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
CVE ID: CVE-2025-42915 State: PUBLISHED Published: 2025-09-09T02:06:32.797Z Last Updated: 2025-09-09T13:47:56.618Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: Fiori app (Manage Payment Blocks) Problem Types: CWE-862 Description: Fiori app Manage Payment Blocks does not perform the necessary authorization checks, allowing an attacker with basic user privileges to abuse functionalities that should be restricted to specific user groups.This issue could impact both the confidentiality and integrity of the application without affecting the availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/
t affecting the availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3409013 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42916 State: PUBLISHED Published: 2025-09-09T02:07:53.085Z Last Updated: 2025-09-09T13:47:28.351Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: SAP_SE Products: SAP S/4HANA (Private Cloud or On-Premise) Problem Types: CWE-1287 Description: Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database but no impact on confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3635475 -
on confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3635475 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42917 State: PUBLISHED Published: 2025-09-09T02:09:10.768Z Last Updated: 2025-09-10T03:56:09.320Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: SAP_SE Products: SAP HCM (Approve Timesheets Fiori 2.0 application) Problem Types: CWE-862 Description: SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a significant impact on the application's integrity, while confidentiality and availability remain unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3643832 - https://ur
affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3643832 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42918 State: PUBLISHED Published: 2025-09-09T02:09:18.915Z Last Updated: 2025-09-09T13:41:50.007Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server for ABAP (Background Processing) Problem Types: CWE-862 Description: SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameters. This results in a low impact on confidentiality, with no impact on integrity or availability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3623504 - https://url.sap/sapsecuritypa
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3623504 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42919 State: PUBLISHED Published: 2025-11-11T00:20:18.388Z Last Updated: 2025-11-12T20:09:44.146Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server Java Problem Types: CWE-22 Description: Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access to sensitive application metadata. This results in a partial compromise of the confidentiality of the information w
cess to sensitive application metadata. This results in a partial compromise of the confidentiality of the information without affecting the integrity or availability of the application server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3643603 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42920 State: PUBLISHED Published: 2025-09-09T02:09:30.802Z Last Updated: 2025-09-09T13:35:03.093Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Supplier Relationship Management Problem Types: CWE-79 Description: Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim clicks on the link, the injected input is processed during the page generation, resulting in the execution of malicious content. This execution allows the attacker to access and modify information wi
resulting in the execution of malicious content. This execution allows the attacker to access and modify information within the victim's browser scope, impacting confidentiality and integrity, while availability remains unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3647098 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42921 State: PUBLISHED Published: 2025-04-17T15:56:03.552Z Last Updated: 2025-04-17T18:03:03.904Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: Toolbox App Problem Types: CWE-297 Description: In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-42922 State: PUBLISHED Published: 2025-09-09T02:09:38.727Z Last Updated: 2025-09-10T03:55:58.525Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP NetWeaver AS Java (Deploy Web Service) Problem Types: CWE-94 Description: SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3643865 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42923 State: PUBLISHED Published: 2025-09-09T02:09:47.744Z Last Updated: 2025-09-09T14:31:26.231Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP Fiori App (F4044 Manage Work Center Groups) Problem Types: CWE-352 Description: Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to send unintended request to the web server. This has low impact on integrity and no impact on confidentiality and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3450692 - https://url.sap/sap
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3450692 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42924 State: PUBLISHED Published: 2025-11-11T00:20:31.304Z Last Updated: 2025-11-12T20:09:38.058Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP S/4HANA landscape (SAP E-Recruiting BSP) Problem Types: CWE-601 Description: SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be redirected to the page controlled by the attacker. This has low impact on confidentiality and integrity of the application with no impact on availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3642398 - https://url.s
ility. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3642398 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42925 State: PUBLISHED Published: 2025-09-09T02:09:55.833Z Last Updated: 2025-09-09T14:27:03.197Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver AS Java (IIOP Service) Problem Types: CWE-341 Description: Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time, the attacker could determine a desired identifier which could enable them to access limited system information. Thi
ime, the attacker could determine a desired identifier which could enable them to access limited system information. This poses a low risk to confidentiality without impacting the integrity or availability of the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3640477 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42926 State: PUBLISHED Published: 2025-09-09T02:10:03.616Z Last Updated: 2025-09-09T14:27:20.231Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server Java Problem Types: CWE-306 Description: SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the system.This vulnerability has a low impact on confidentiality and does not affect the integrity or availability of th
he system.This vulnerability has a low impact on confidentiality and does not affect the integrity or availability of the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3619465 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42927 State: PUBLISHED Published: 2025-09-09T02:10:11.874Z Last Updated: 2025-09-09T14:18:59.720Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver AS Java (Adobe Document Service) Problem Types: CWE-1395 Description: SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would allow user with high system privileges to access and modify system information.This vulnerability has a low impact on confidentiality and integrity, with no impact on availability. Additional Analyst Notes: -
erability has a low impact on confidentiality and integrity, with no impact on availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3525295 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42929 State: PUBLISHED Published: 2025-09-09T02:10:59.447Z Last Updated: 2025-09-09T13:56:41.986Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: SAP_SE Products: SAP Landscape Transformation Replication Server Problem Types: CWE-1287 Description: Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3633002 - https://url.sap/sapsecurit
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3633002 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42930 State: PUBLISHED Published: 2025-09-09T02:11:18.387Z Last Updated: 2025-09-09T13:32:49.181Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP_SE Products: SAP Business Planning and Consolidation Problem Types: CWE-606 Description: SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the availability of the application, there is no impact on confidentiality or integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
, there is no impact on confidentiality or integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3614067 - https://url.sap/sapsecuritypatchday