Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
if the debug interface is still enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jumo.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-086.json
CVE ID: CVE-2025-41733 State: PUBLISHED Published: 2025-11-18T10:17:46.326Z Last Updated: 2025-11-18T21:17:53.438Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: METZ CONNECT Products: Energy-Controlling EWIO2-M, Energy-Controlling EWIO2-M-BM, Ethernet-IO EWIO2-BM Problem Types: CWE-305 Description: The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-097
CVE ID: CVE-2025-41734 State: PUBLISHED Published: 2025-11-18T10:18:00.774Z Last Updated: 2025-11-18T21:00:09.059Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: METZ CONNECT Products: Energy-Controlling EWIO2-M, Energy-Controlling EWIO2-M-BM, Ethernet-IO EWIO2-BM Problem Types: CWE-98 Description: An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-097
CVE ID: CVE-2025-41735 State: PUBLISHED Published: 2025-11-18T10:18:15.146Z Last Updated: 2025-11-18T20:58:43.162Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: METZ CONNECT Products: Energy-Controlling EWIO2-M, Energy-Controlling EWIO2-M-BM, Ethernet-IO EWIO2-BM Problem Types: CWE-434 Description: A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-097
CVE ID: CVE-2025-41736 State: PUBLISHED Published: 2025-11-18T10:18:30.034Z Last Updated: 2025-11-18T20:54:27.218Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: METZ CONNECT Products: Energy-Controlling EWIO2-M, Energy-Controlling EWIO2-M-BM, Ethernet-IO EWIO2-BM Problem Types: CWE-35 Description: A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-097
CVE ID: CVE-2025-41737 State: PUBLISHED Published: 2025-11-18T10:18:44.739Z Last Updated: 2025-11-18T20:50:56.375Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: METZ CONNECT Products: Energy-Controlling EWIO2-M, Energy-Controlling EWIO2-M-BM, Ethernet-IO EWIO2-BM Problem Types: CWE-284 Description: Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-097
CVE ID: CVE-2025-42598 State: PUBLISHED Published: 2025-04-28T08:20:56.756Z Last Updated: 2025-04-28T16:10:51.558Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SEIKO EPSON CORPORATION Products: SEIKO EPSON printer drivers for Windows OS Problem Types: CWE-276 Description: Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a language other than English. If a user is directed to place a crafted DLL file in a location of an attacker's choosing, the attacker may execute arbitrary code with SYSTEM privilege on a Windows system on which the printer driver is installed. Additiona
may execute arbitrary code with SYSTEM privilege on a Windows system on which the printer driver is installed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.epson.co.uk/en_GB/faq/KA-01993/contents?loc=en-us - https://www.epson.jp/support/misc_t/250428_oshirase.htm - https://www2.epson.jp/support/misc_t/windrv_productlist.pdf - https://jvn.jp/en/vu/JVNVU90649144/
CVE ID: CVE-2025-42599 State: PUBLISHED Published: 2025-04-18T03:52:48.607Z Last Updated: 2025-10-21T22:55:18.624Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QUALITIA CO., LTD. Products: Active! mail 6 Problem Types: CWE-121 Description: Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qualitia.com/jp/news/2025/04/18_1030.html - https://jvn.jp/en/jp/
es: - CISA ADP Vulnrichment: References: - https://www.qualitia.com/jp/news/2025/04/18_1030.html - https://jvn.jp/en/jp/JVN22348866/
CVE ID: CVE-2025-42600 State: PUBLISHED Published: 2025-04-23T10:25:16.725Z Last Updated: 2025-04-23T15:29:56.184Z Vendors: Meon Products: KYC solutions Problem Types: CWE-307 Description: This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password (OTP) attempts through certain API endpoints of login process. A remote attacker could exploit this vulnerability by performing a brute force attack on OTP, which could lead to gain unauthorized access to other user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082
CVE ID: CVE-2025-42601 State: PUBLISHED Published: 2025-04-23T10:32:30.140Z Last Updated: 2025-04-23T15:28:27.959Z Vendors: Meon Products: KYC solutions Problem Types: CWE-602 Description: This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote attacker could exploit this vulnerability by intercepting the request and removing the Captcha parameter leading to bypassing the Captcha verification mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082
CVE ID: CVE-2025-42602 State: PUBLISHED Published: 2025-04-23T10:36:07.815Z Last Updated: 2025-04-23T15:24:45.155Z Vendors: Meon Products: KYC solutions Problem Types: CWE-613, CWE-384 Description: This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentication process. A remote attacker could exploit this vulnerability by intercepting and manipulating the responses through API request body leading to unauthorized access of other user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082
CVE ID: CVE-2025-42603 State: PUBLISHED Published: 2025-04-23T10:38:49.256Z Last Updated: 2025-04-23T15:09:03.563Z Vendors: Meon Products: KYC solutions Problem Types: CWE-319 Description: This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting API response that contains unencrypted sensitive information belonging to other users. Successful exploitation of this vulnerability could allow remote attacker to impersonate the target user and gain unauthorized access to the user account. Additional Analyst Notes: -
e attacker to impersonate the target user and gain unauthorized access to the user account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082
CVE ID: CVE-2025-42604 State: PUBLISHED Published: 2025-04-23T10:43:56.953Z Last Updated: 2025-04-23T14:44:52.451Z Vendors: Meon Products: KYC solutions Problem Types: CWE-1295 Description: This vulnerability exists in Meon KYC solutions due to debug mode is enabled in certain API endpoints. A remote attacker could exploit this vulnerability by accessing certain unauthorized API endpoints leading to detailed error messages as response leading to disclosure of system related information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082
CVE ID: CVE-2025-42605 State: PUBLISHED Published: 2025-04-23T10:51:00.255Z Last Updated: 2025-04-23T14:26:50.939Z Vendors: Meon Products: Bidding Solutions Problem Types: CWE-639 Description: This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modification, or cancellation operations. An authenticated remote attacker could exploit this vulnerability by manipulating parameter in the API request body to gain unauthorized access to other user accounts. Successful exploitation of this vulnerability could allow remote attacker to perform authorized manipulation of data associated with other user accounts. Additio
lity could allow remote attacker to perform authorized manipulation of data associated with other user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082
CVE ID: CVE-2025-42701 State: PUBLISHED Published: 2025-10-08T17:18:32.434Z Last Updated: 2025-10-08T19:26:49.280Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: CrowdStrike Products: Falcon sensor for Windows Problem Types: CWE-367 Description: A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors. There is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence tea
TV) sensors. There is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence team are actively monitoring for exploitation and we maintain visibility into any such attempts. The Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this. CrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.crowdstrike.com/en-us/security-advisories/issues-affecting-crowdstrike-falcon-sensor-for-windows/
CVE ID: CVE-2025-42706 State: PUBLISHED Published: 2025-10-08T17:18:15.168Z Last Updated: 2025-10-08T19:27:00.996Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: CrowdStrike Products: Falcon sensor for Windows Problem Types: CWE-346 Description: A logic error exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors. There is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence teams
sensors. There is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence teams are actively monitoring for exploitation and we maintain visibility into any such attempts. The Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this. CrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.crowdstrike.com/en-us/security-advisories/issues-affecting-crowdstrike-falcon-sensor-for-windows/
CVE ID: CVE-2025-42882 State: PUBLISHED Published: 2025-11-11T00:13:33.144Z Last Updated: 2025-11-12T20:11:58.984Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server for ABAP Problem Types: CWE-862 Description: Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system could further assist this attacker to plan subsequent attacks. As a result, this vulnerability has a low impact o
system could further assist this attacker to plan subsequent attacks. As a result, this vulnerability has a low impact on confidentiality, with no impact on the integrity or availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3643337 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42883 State: PUBLISHED Published: 2025-11-11T00:13:47.788Z Last Updated: 2025-11-12T20:11:48.613Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server for ABAP (Migration Workbench) Problem Types: CWE-434 Description: Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges uploads files to the application server. An attacker could leverage this and upload a malicious file into the system. This results in a low impact on the integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrich
system. This results in a low impact on the integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3634053 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42884 State: PUBLISHED Published: 2025-11-11T00:14:02.774Z Last Updated: 2025-11-12T20:11:40.031Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Enterprise Portal Problem Types: CWE-943 Description: SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/36
no impact on availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3660969 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42885 State: PUBLISHED Published: 2025-11-11T00:14:17.468Z Last Updated: 2025-11-12T20:11:31.942Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP HANA 2.0 (hdbrss) Problem Types: CWE-306 Description: Due to missing authentication, SAP HANA 2.0 (hdbrss) allows an unauthenticated attacker to call a remote-enabled function that will enable them to view information. As a result, it has a low impact on the confidentiality but no impact on the integrity and availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3639264 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42886 State: PUBLISHED Published: 2025-11-11T00:14:33.364Z Last Updated: 2025-11-12T20:11:23.922Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Business Connector Problem Types: CWE-79 Description: Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim's browser context. This could allow the attacker to access or modify informatio
ution of malicious content in the victim's browser context. This could allow the attacker to access or modify information within the victim�s browser scope, impacting confidentiality and integrity, while availability remains unaffected Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3665907 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42887 State: PUBLISHED Published: 2025-11-11T00:14:45.636Z Last Updated: 2025-11-12T20:11:17.705Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Solution Manager Problem Types: CWE-94 Description: Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3668705 - https://url.sa
stem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3668705 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42888 State: PUBLISHED Published: 2025-11-11T00:15:00.675Z Last Updated: 2025-11-12T20:11:11.635Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP GUI for Windows Problem Types: CWE-316 Description: SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process memory during runtime.This vulnerability has a high impact on confidentiality, with no impact on integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3651097 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42889 State: PUBLISHED Published: 2025-11-11T00:15:14.933Z Last Updated: 2025-11-12T20:11:06.168Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Starter Solution (PL SAFT) Problem Types: CWE-89 Description: SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerability has a low impact on the application's confidentiality and integrity but no impact on its availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/2886616 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42890 State: PUBLISHED Published: 2025-11-11T00:15:29.439Z Last Updated: 2025-11-12T04:57:41.298Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SQL Anywhere Monitor (Non-Gui) Problem Types: CWE-798 Description: SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitrary code execution.This could cause high impact on confidentiality integrity and availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3666261 - https://url.sap/sapsecuritypatch
nalyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3666261 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42892 State: PUBLISHED Published: 2025-11-11T00:17:18.198Z Last Updated: 2025-11-12T20:10:20.782Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Business Connector Problem Types: CWE-78 Description: Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating system commands. Successful exploitation could lead to full compromise of the system�s confidentiality, integrity, and availability. A
s. Successful exploitation could lead to full compromise of the system�s confidentiality, integrity, and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3665900 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42893 State: PUBLISHED Published: 2025-11-11T00:17:34.419Z Last Updated: 2025-11-12T20:10:13.708Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Business Connector Problem Types: CWE-601 Description: Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site displayed within an embedded frame. Successful exploitation could allow the attacker to steal sensitive information and perform unauthorized actions, impacting the confidentiality and integrity of web client data. There is no imp
mation and perform unauthorized actions, impacting the confidentiality and integrity of web client data. There is no impact to system availability resulting from this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3662000 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42894 State: PUBLISHED Published: 2025-11-11T00:19:22.282Z Last Updated: 2025-11-12T04:57:41.966Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Business Connector Problem Types: CWE-22 Description: Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system commands on the server, resulting in a complete compromise of the confidentiality, integrity, and availability of the affected syst
the server, resulting in a complete compromise of the confidentiality, integrity, and availability of the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3666038 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42895 State: PUBLISHED Published: 2025-11-11T00:19:38.409Z Last Updated: 2025-11-12T20:10:07.123Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H) Vendors: SAP_SE Products: SAP HANA JDBC Client Problem Types: CWE-94 Description: Due to insufficient validation of connection property values, the SAP HANA JDBC Client allows a high-privilege locally authenticated user to supply crafted parameters that lead to unauthorized code loading, resulting in low impact on confidentiality and integrity and high impact on availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3643385 - https://url.sa
tion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3643385 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-42897 State: PUBLISHED Published: 2025-11-11T00:19:50.996Z Last Updated: 2025-11-12T20:09:58.072Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Business One (SLD) Problem Types: CWE-522 Description: Due to information disclosure vulnerability in anonymous API provided by SAP Business One (SLD), an attacker with normal user access could gain access to unauthorized information. As a result, it has a low impact on the confidentiality of the application but no impact on the integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3652901 - https://url.sap/sapsecu