Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2024-39592 (GCVE-0-2024-39592)
Vulnerability from cvelistv5
Published
2024-07-09 03:45
Modified
2024-08-02 04:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
Elements of PDCE does not perform necessary
authorization checks for an authenticated user, resulting in escalation of
privileges.
This
allows an attacker to read sensitive information causing high impact on the
confidentiality of the application.
References
| URL | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:sap_se:sap_pdce:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sap_pdce",
"vendor": "sap_se",
"versions": [
{
"status": "affected",
"version": "S4CORE 102"
},
{
"status": "affected",
"version": "S4CORE 103"
},
{
"status": "affected",
"version": "S4COREOP 104"
},
{
"status": "affected",
"version": "S4COREOP 105"
},
{
"status": "affected",
"version": "S4COREOP 106"
},
{
"status": "affected",
"version": "S4COREOP 107"
},
{
"status": "affected",
"version": "S4COREOP 108"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39592",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-24T18:22:20.617499Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T18:33:09.047Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:26:15.969Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://url.sap/sapsecuritypatchday"
},
{
"tags": [
"x_transferred"
],
"url": "https://me.sap.com/notes/3483344"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SAP PDCE",
"vendor": "SAP_SE",
"versions": [
{
"status": "affected",
"version": "S4CORE 102"
},
{
"status": "affected",
"version": "S4CORE 103"
},
{
"status": "affected",
"version": "S4COREOP 104"
},
{
"status": "affected",
"version": "S4COREOP 105"
},
{
"status": "affected",
"version": "S4COREOP 106"
},
{
"status": "affected",
"version": "S4COREOP 107"
},
{
"status": "affected",
"version": "S4COREOP 108"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eElements of PDCE does not perform necessary\nauthorization checks for an authenticated user, resulting in escalation of\nprivileges.\u003c/p\u003e\n\nThis\nallows an attacker to read sensitive information causing high impact on the\nconfidentiality of the application.\n\n\n\n"
}
],
"value": "Elements of PDCE does not perform necessary\nauthorization checks for an authenticated user, resulting in escalation of\nprivileges.\n\n\n\nThis\nallows an attacker to read sensitive information causing high impact on the\nconfidentiality of the application."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-09T03:45:56.018Z",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"url": "https://url.sap/sapsecuritypatchday"
},
{
"url": "https://me.sap.com/notes/3483344"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "[CVE-2024-39592] Missing Authorization check in SAP PDCE",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2024-39592",
"datePublished": "2024-07-09T03:45:56.018Z",
"dateReserved": "2024-06-26T09:58:24.095Z",
"dateUpdated": "2024-08-02T04:26:15.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-39592\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2024-07-09T04:15:13.420\",\"lastModified\":\"2024-11-21T09:28:04.573\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Elements of PDCE does not perform necessary\\nauthorization checks for an authenticated user, resulting in escalation of\\nprivileges.\\n\\n\\n\\nThis\\nallows an attacker to read sensitive information causing high impact on the\\nconfidentiality of the application.\"},{\"lang\":\"es\",\"value\":\"Elements of PDCE no realiza las verificaciones de autorizaci\u00f3n necesarias para un usuario autenticado, lo que resulta en una escalada de privilegios. Esto permite a un atacante leer informaci\u00f3n confidencial causando un alto impacto en la confidencialidad de la aplicaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@sap.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":4.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"cna@sap.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"04C95A73-48EB-446C-A5F0-20E1D6BC1779\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C3C9003-68A6-4886-8979-9B7D01A35E40\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s4coreop:104:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"666D246E-3DF3-494C-8BD6-6C2F7C0D78C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s4coreop:105:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6B6F939-A3CD-4C0C-A6E7-E3BD4ADB5288\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s4coreop:106:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"02AEDF75-D0D4-4221-BB40-9A8DC51FA84D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s4coreop:107:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"81ABE589-A7D1-42EF-B5A9-A94C8D0AE3AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:s4coreop:108:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C1E9400-4CEB-4185-BC03-72B7F59DF03C\"}]}]}],\"references\":[{\"url\":\"https://me.sap.com/notes/3483344\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://url.sap/sapsecuritypatchday\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://me.sap.com/notes/3483344\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://url.sap/sapsecuritypatchday\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39592\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-24T18:22:20.617499Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:sap_se:sap_pdce:*:*:*:*:*:*:*:*\"], \"vendor\": \"sap_se\", \"product\": \"sap_pdce\", \"versions\": [{\"status\": \"affected\", \"version\": \"S4CORE 102\"}, {\"status\": \"affected\", \"version\": \"S4CORE 103\"}, {\"status\": \"affected\", \"version\": \"S4COREOP 104\"}, {\"status\": \"affected\", \"version\": \"S4COREOP 105\"}, {\"status\": \"affected\", \"version\": \"S4COREOP 106\"}, {\"status\": \"affected\", \"version\": \"S4COREOP 107\"}, {\"status\": \"affected\", \"version\": \"S4COREOP 108\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-24T18:31:14.221Z\"}}], \"cna\": {\"title\": \"[CVE-2024-39592] Missing Authorization check in SAP PDCE\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SAP_SE\", \"product\": \"SAP PDCE\", \"versions\": [{\"status\": \"affected\", \"version\": \"S4CORE 102\"}, {\"status\": \"affected\", \"version\": \"S4CORE 103\"}, {\"status\": \"affected\", \"version\": \"S4COREOP 104\"}, {\"status\": \"affected\", \"version\": \"S4COREOP 105\"}, {\"status\": \"affected\", \"version\": \"S4COREOP 106\"}, {\"status\": \"affected\", \"version\": \"S4COREOP 107\"}, {\"status\": \"affected\", \"version\": \"S4COREOP 108\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://url.sap/sapsecuritypatchday\"}, {\"url\": \"https://me.sap.com/notes/3483344\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Elements of PDCE does not perform necessary\\nauthorization checks for an authenticated user, resulting in escalation of\\nprivileges.\\n\\n\\n\\nThis\\nallows an attacker to read sensitive information causing high impact on the\\nconfidentiality of the application.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eElements of PDCE does not perform necessary\\nauthorization checks for an authenticated user, resulting in escalation of\\nprivileges.\u003c/p\u003e\\n\\nThis\\nallows an attacker to read sensitive information causing high impact on the\\nconfidentiality of the application.\\n\\n\\n\\n\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"shortName\": \"sap\", \"dateUpdated\": \"2024-07-09T03:45:56.018Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-39592\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-07-24T18:33:09.047Z\", \"dateReserved\": \"2024-06-26T09:58:24.095Z\", \"assignerOrgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"datePublished\": \"2024-07-09T03:45:56.018Z\", \"assignerShortName\": \"sap\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
CERTFR-2024-AVI-0844
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | NetWeaver BW | NetWeaver BW (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Backoffice versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4 HANA (Manage Bank Statements) versions S4CORE, 102, 103, 104, 105, 106 et 107 sans le dernier correctif de sécurité | ||
| SAP | N/A | Student Life Cycle Management (SLcM) versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de sécurité | ||
| SAP | NetWeaver Enterprise Portal | NetWeaver Enterprise Portal (KMC) version KMC-BC 7.5 sans le dernier correctif de sécurité | ||
| SAP | N/A | PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 420, 430, 2025, ENTERPRISECLIENTTOOLS 420, 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | N/A | HANA Client version HDB_CLIENT 2.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS for Java version 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | SAP NetWeaver Application Server pour plateformes ABAP et ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Enterprise Project Connection version 3.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver BW (BEx Analyzer) versions DW4CORE 200, DW4CORE 300, DW4CORE 400, SAP_BW 700, SAP_BW 701, SAP_BW 702, SAP_BW 731, SAP_BW 740, SAP_BW 750, SAP_BW 751, SAP_BW 752, SAP_BW 753, SAP_BW 754, SAP_BW 755, SAP_BW 756, SAP_BW 757 et SAP_BW 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver BW",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Backoffice versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4 HANA (Manage Bank Statements) versions S4CORE, 102, 103, 104, 105, 106 et 107 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Student Life Cycle Management (SLcM) versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal (KMC) version KMC-BC 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "NetWeaver Enterprise Portal",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 420, 430, 2025, ENTERPRISECLIENTTOOLS 420, 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HANA Client version HDB_CLIENT 2.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for Java version 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAP NetWeaver Application Server pour plateformes ABAP et ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Enterprise Project Connection version 3.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-45282",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45282"
},
{
"name": "CVE-2024-42373",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42373"
},
{
"name": "CVE-2024-38809",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38809"
},
{
"name": "CVE-2024-41729",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41729"
},
{
"name": "CVE-2024-37180",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37180"
},
{
"name": "CVE-2024-45278",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45278"
},
{
"name": "CVE-2024-45283",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45283"
},
{
"name": "CVE-2024-45277",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45277"
},
{
"name": "CVE-2024-38808",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38808"
},
{
"name": "CVE-2024-47594",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47594"
},
{
"name": "CVE-2022-23302",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23302"
},
{
"name": "CVE-2024-22259",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22259"
},
{
"name": "CVE-2024-39592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39592"
},
{
"name": "CVE-2024-41730",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41730"
},
{
"name": "CVE-2024-37179",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37179"
}
],
"initial_release_date": "2024-10-08T00:00:00",
"last_revision_date": "2024-10-08T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0844",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-10-08T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 SAP october-2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2024.html"
}
]
}
CERTFR-2024-AVI-0554
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | Enable Now versions antérieures à WPB_MANAGER_HANA 10 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Workflow (WebFlow Services) versions antérieures à SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Enable Now versions antérieures à WPB_MANAGER_CE 10 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Warehouse - Business Planning and Simulation versions antérieures à SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce versions antérieures à HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | Enable Now versions antérieures à ENABLE_NOW_CONSUMP_DEL 1704 sans le dernier correctif de sécurité | ||
| SAP | N/A | CRM WebClient UI versions antérieures à S4FND 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité WEBCUIF 701, 731, 746, 747, 748, 800, 801 | ||
| SAP | N/A | CRM WebClient UI versions antérieures à S4FND 104 sans le dernier correctif de sécurité | ||
| SAP | N/A | PDCE versions antérieures à S4CORE 102 et 103 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Warehouse - Business Planning and Simulation versions antérieures à SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4HANA Finance (Advanced Payment Management) versions antérieures à S4CORE 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server for ABAP and ABAP Platform versions antérieures à SAP_BASIS 700,701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 795 et 796 sans le dernier correctif de sécurité | ||
| SAP | N/A | GUI pour Windows versions antérieures à BC-FES-GUI 8 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Knowledge Management XMLEditor versions antérieures à KMC-WPC 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | CRM WebClient UI versions antérieures à WEBCUIF 701, 731, 746, 747, 748, 800, 801 sans le dernier correctif de sécurité | ||
| SAP | N/A | PDCE versions antérieures à S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Enable Now versions ant\u00e9rieures \u00e0 WPB_MANAGER_HANA 10 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Workflow (WebFlow Services) versions ant\u00e9rieures \u00e0 SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Enable Now versions ant\u00e9rieures \u00e0 WPB_MANAGER_CE 10 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse - Business Planning and Simulation versions ant\u00e9rieures \u00e0 SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce versions ant\u00e9rieures \u00e0 HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Enable Now versions ant\u00e9rieures \u00e0 ENABLE_NOW_CONSUMP_DEL 1704 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM WebClient UI versions ant\u00e9rieures \u00e0 S4FND 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9 WEBCUIF 701, 731, 746, 747, 748, 800, 801",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM WebClient UI versions ant\u00e9rieures \u00e0 S4FND 104 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions ant\u00e9rieures \u00e0 S4CORE 102 et 103 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse - Business Planning and Simulation versions ant\u00e9rieures \u00e0 SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA Finance (Advanced Payment Management) versions ant\u00e9rieures \u00e0 S4CORE 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP and ABAP Platform versions ant\u00e9rieures \u00e0 SAP_BASIS 700,701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 795 et 796 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "GUI pour Windows versions ant\u00e9rieures \u00e0 BC-FES-GUI 8 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Knowledge Management XMLEditor versions ant\u00e9rieures \u00e0 KMC-WPC 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM WebClient UI versions ant\u00e9rieures \u00e0 WEBCUIF 701, 731, 746, 747, 748, 800, 801 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions ant\u00e9rieures \u00e0 S4COREOP 104, 105,\n106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-34689",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34689"
},
{
"name": "CVE-2024-37174",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37174"
},
{
"name": "CVE-2024-39597",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39597"
},
{
"name": "CVE-2024-37171",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37171"
},
{
"name": "CVE-2024-37172",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37172"
},
{
"name": "CVE-2024-34685",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34685"
},
{
"name": "CVE-2024-39596",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39596"
},
{
"name": "CVE-2024-34683",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34683"
},
{
"name": "CVE-2024-37180",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37180"
},
{
"name": "CVE-2024-39600",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39600"
},
{
"name": "CVE-2024-37175",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37175"
},
{
"name": "CVE-2024-39594",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39594"
},
{
"name": "CVE-2024-37173",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37173"
},
{
"name": "CVE-2024-39599",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39599"
},
{
"name": "CVE-2024-39598",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39598"
},
{
"name": "CVE-2024-39593",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39593"
},
{
"name": "CVE-2024-39592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39592"
},
{
"name": "CVE-2024-34692",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34692"
},
{
"name": "CVE-2024-39595",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39595"
}
],
"initial_release_date": "2024-07-09T00:00:00",
"last_revision_date": "2024-07-09T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0554",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-07-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 SAP",
"url": "https://support.sap.com/content/dam/support/en_us/library/ssp/my-support/knowledge-base/security-notes-news/2024%2007%20Patch%20Day%20Blog%20V1.pdf"
}
]
}
CERTFR-2025-AVI-0396
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | S/4HANA | S/4HANA HCM Portugal and SAP ERP HCM Portugal versions S4HCMCPT 100, 101, SAP_HRCPT 600, 604 et 608 | ||
| SAP | N/A | Service Parts Management (SPM) versions SAP_APPL 600, 602, 603, 604, 605, 606, 616, 617, 618, SAPSCORE 111, S4CORE 100, 101 et 102 | ||
| SAP | NetWeaver | NetWeaver (Visual Composer development server) version VCFRAMEWORK 7.50 | ||
| SAP | N/A | Supplier Relationship Management (Master Data Management Catalog) version SRM_MDM_CAT 7.52 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 2025 | ||
| SAP | N/A | Business Objects Business Intelligence Platform (PMW) versions ENTERPRISE 430, 2025 et 2027 | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 | ||
| SAP | N/A | Data Services Management Console version SBOP DS JOB SERVER 4.3 | ||
| SAP | N/A | Digital Manufacturing (Production Operator Dashboard) version CTNR-DME-PODFOUNDATION-MS 1.0 | ||
| SAP | N/A | Fiori for SAP ERP versions SAP_GWFND 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 | ||
| SAP | S/4HANA | S4/HANA (OData meta-data property) versions S4CORE 102, 103, 104, 105 et 106 | ||
| SAP | S/4HANA | S/4HANA (Private Cloud & On-Premise) versions S4CRM 204, 205, 206, S4CEXT 107, 108, BBPCRM 702, 712, 713, 714 | ||
| SAP | S/4HANA | S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) versions S4CORE 102, 103, 104, 105, 106, 107, 108, SCM_BASIS 700, 701, 702, 712, 713 et 714 | ||
| SAP | N/A | Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758 | ||
| SAP | N/A | Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14 | ||
| SAP | N/A | Service Parts Management (SPM) versions SAP_APPL 617, 618, SAPSCORE 116, S4CORE 100, 101, 102 et 103 | ||
| SAP | N/A | PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 | ||
| SAP | N/A | Landscape Transformation (PCL Basis) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752, 2020, S4CORE 102, 103, 104, 105, 106, 107 et 108 | ||
| SAP | N/A | GUI for Windows version BC-FES-GUI 8.00 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "S/4HANA HCM Portugal and SAP ERP HCM Portugal versions S4HCMCPT 100, 101, SAP_HRCPT 600, 604 et 608",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Service Parts Management (SPM) versions SAP_APPL 600, 602, 603, 604, 605, 606, 616, 617, 618, SAPSCORE 111, S4CORE 100, 101 et 102",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (Visual Composer development server) version VCFRAMEWORK 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (Master Data Management Catalog) version SRM_MDM_CAT 7.52",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 2025",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform (PMW) versions ENTERPRISE 430, 2025 et 2027",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Data Services Management Console version SBOP DS JOB SERVER 4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Digital Manufacturing (Production Operator Dashboard) version CTNR-DME-PODFOUNDATION-MS 1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori for SAP ERP versions SAP_GWFND 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S4/HANA (OData meta-data property) versions S4CORE 102, 103, 104, 105 et 106",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Private Cloud \u0026 On-Premise) versions S4CRM 204, 205, 206, S4CEXT 107, 108, BBPCRM 702, 712, 713, 714",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) versions S4CORE 102, 103, 104, 105, 106, 107, 108, SCM_BASIS 700, 701, 702, 712, 713 et 714",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Service Parts Management (SPM) versions SAP_APPL 617, 618, SAPSCORE 116, S4CORE 100, 101, 102 et 103",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Landscape Transformation (PCL Basis) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752, 2020, S4CORE 102, 103, 104, 105, 106, 107 et 108",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "GUI for Windows version BC-FES-GUI 8.00",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-43003",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43003"
},
{
"name": "CVE-2025-43007",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43007"
},
{
"name": "CVE-2025-23191",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23191"
},
{
"name": "CVE-2025-42999",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42999"
},
{
"name": "CVE-2025-43009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43009"
},
{
"name": "CVE-2025-43011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43011"
},
{
"name": "CVE-2025-43006",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43006"
},
{
"name": "CVE-2025-0060",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0060"
},
{
"name": "CVE-2025-30012",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30012"
},
{
"name": "CVE-2025-43000",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43000"
},
{
"name": "CVE-2025-43004",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43004"
},
{
"name": "CVE-2025-31324",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31324"
},
{
"name": "CVE-2025-43005",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43005"
},
{
"name": "CVE-2025-43008",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43008"
},
{
"name": "CVE-2025-31329",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31329"
},
{
"name": "CVE-2025-30009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30009"
},
{
"name": "CVE-2025-30011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30011"
},
{
"name": "CVE-2025-43002",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43002"
},
{
"name": "CVE-2025-26662",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26662"
},
{
"name": "CVE-2025-30010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30010"
},
{
"name": "CVE-2025-42997",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42997"
},
{
"name": "CVE-2025-0061",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0061"
},
{
"name": "CVE-2025-43010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43010"
},
{
"name": "CVE-2024-39592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39592"
},
{
"name": "CVE-2025-30018",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30018"
}
],
"initial_release_date": "2025-05-13T00:00:00",
"last_revision_date": "2025-06-12T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0396",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-05-13T00:00:00.000000"
},
{
"description": "Ajout des identifiants CVE CVE-2025-0060, CVE-2025-0061 et CVE-2025-23191",
"revision_date": "2025-06-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-05-13",
"title": "Bulletin de s\u00e9curit\u00e9 SAP may-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2025.html"
}
]
}
CERTFR-2025-AVI-0190
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | Electronic Invoicing for Brazil (eDocument Cockpit) versions SAP_APPL 617, 618, S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | Just In Time versions S4CORE 102, 103, 104, 105, 106, 107, 108 et ECC-DIMP 618 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 914 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Objects Business Intelligence Platform versions ENTERPRISE 430, 2025,2027, ENTERPRISECLIENTTOOLS 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | N/A | Permit to Work versions UIS4HOP1 800 et 900 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Cloud et Datahub, versions Y_COM 2205, HY_DHUB 2205, COM_CLOUD 2211 et DHUB_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP (applications based on GUI for HTML) versions KRNL64UC 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.89, KERNEL 7.93 et KERNEL 9.14 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Cloud versions Y-COM 2205 et COM-CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver (ABAP Class Builder) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 914 sans le dernier correctif de sécurité | ||
| SAP | N/A | Web Dispatcher et Internet Communication Manager versions KRNL64UC 7.53, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.89, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.89, KERNEL 7.93 et KERNEL 9.14 sans le dernier correctif de sécurité | ||
| SAP | N/A | PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Enterprise Portal (OBN component) version EP-RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business One (Service Layer) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de sécurité | ||
| SAP | N/A | Fiori apps (Posting Library) versions S4CORE 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server Java version AJAX-RUNTIME 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | CRM et S/4HANA (Interaction Center) versions S4CRM 100, 200, 204, 205, 206, S4FND 102, 103, 104, 105, 106, 107, 108, S4CEXT 107, 108, BBPCRM 701, 702, 712, 713, 714, WEBCUIF 701, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Objects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Warehouse (Process Chains) versions DW4CORE 100, DW4CORE 200, DW4CORE 300, DW4CORE 400, DW4CORE 914, SAP_BW 730, SAP_BW 731, SAP_BW 740 et SAP_BW 750 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4HANA (RBD) versions S4CORE 102, 103, 104, 105, 106, 107, 108, EA-FINSERV 618 et EA-FINSERV 800 sans le dernier correctif de sécurité | ||
| SAP | N/A | Bibliothèque @sap/approuter versions antérieures à 16.7.1 | ||
| SAP | N/A | Commerce (Swagger UI) version COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | S/4HANA (Manage Bank Statements) versions S4CORE 107 et S4CORE 108 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Electronic Invoicing for Brazil (eDocument Cockpit) versions SAP_APPL 617, 618, S4CORE 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Just In Time versions S4CORE 102, 103, 104, 105, 106, 107, 108 et ECC-DIMP 618 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 914 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform versions ENTERPRISE 430, 2025,2027, ENTERPRISECLIENTTOOLS 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Permit to Work versions UIS4HOP1 800 et 900 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud et Datahub, versions Y_COM 2205, HY_DHUB 2205, COM_CLOUD 2211 et DHUB_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP (applications based on GUI for HTML) versions KRNL64UC 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.89, KERNEL 7.93 et KERNEL 9.14 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions Y-COM 2205 et COM-CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (ABAP Class Builder) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 914 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Web Dispatcher et Internet Communication Manager versions KRNL64UC 7.53, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.89, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.89, KERNEL 7.93 et KERNEL 9.14 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal (OBN component) version EP-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business One (Service Layer) versions B1_ON_HANA 10.0 et SAP-M-BO 10.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori apps (Posting Library) versions S4CORE 103, 104, 105, 106, 107 et 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server Java version AJAX-RUNTIME 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM et S/4HANA (Interaction Center) versions S4CRM 100, 200, 204, 205, 206, S4FND 102, 103, 104, 105, 106, 107, 108, S4CEXT 107, 108, BBPCRM 701, 702, 712, 713, 714, WEBCUIF 701, 731, 746, 747, 748, 800 et 801 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse (Process Chains) versions DW4CORE 100, DW4CORE 200, DW4CORE 300, DW4CORE 400, DW4CORE 914, SAP_BW 730, SAP_BW 731, SAP_BW 740 et SAP_BW 750 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (RBD) versions S4CORE 102, 103, 104, 105, 106, 107, 108, EA-FINSERV 618 et EA-FINSERV 800 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Biblioth\u00e8que @sap/approuter versions ant\u00e9rieures \u00e0 16.7.1",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce (Swagger UI) version COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Manage Bank Statements) versions S4CORE 107 et S4CORE 108 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-26661",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26661"
},
{
"name": "CVE-2025-27433",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27433"
},
{
"name": "CVE-2024-38286",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38286"
},
{
"name": "CVE-2025-25245",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25245"
},
{
"name": "CVE-2024-38819",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38819"
},
{
"name": "CVE-2025-23194",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23194"
},
{
"name": "CVE-2025-26660",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26660"
},
{
"name": "CVE-2025-25244",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25244"
},
{
"name": "CVE-2024-38820",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38820"
},
{
"name": "CVE-2025-26658",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26658"
},
{
"name": "CVE-2025-24876",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24876"
},
{
"name": "CVE-2025-23188",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23188"
},
{
"name": "CVE-2025-27434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27434"
},
{
"name": "CVE-2025-0062",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0062"
},
{
"name": "CVE-2025-26659",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26659"
},
{
"name": "CVE-2024-41736",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41736"
},
{
"name": "CVE-2025-27432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27432"
},
{
"name": "CVE-2025-26656",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26656"
},
{
"name": "CVE-2025-23185",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23185"
},
{
"name": "CVE-2025-25242",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25242"
},
{
"name": "CVE-2025-27430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27430"
},
{
"name": "CVE-2025-27431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27431"
},
{
"name": "CVE-2025-26655",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26655"
},
{
"name": "CVE-2024-39592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39592"
},
{
"name": "CVE-2025-0071",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0071"
},
{
"name": "CVE-2025-27436",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27436"
},
{
"name": "CVE-2024-52316",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52316"
}
],
"initial_release_date": "2025-03-11T00:00:00",
"last_revision_date": "2025-03-11T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0190",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-03-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 SAP march-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2025.html"
}
]
}
ncsc-2025-0149
Vulnerability from csaf_ncscnl
Published
2025-05-13 09:05
Modified
2025-05-13 09:05
Summary
Kwetsbaarheden verholpen in SAP producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
SAP heeft meerdere kwetsbaarheden verholpen in diverse SAP producten, zoals NetWeaver, NetWeaver Visual Composer, SAP GUI, pcde, Business Objects, HANA en andere componenten.
Interpretaties
De kwetsbaarheden omvatten onder andere een onbeperkte bestandsuploadfout die ongeauthenticeerde gebruikers in staat stelt om kwaadaardige bestanden te uploaden, wat kan leiden tot uitvoer van willekeurige code. Daarnaast zijn er kwetsbaarheden gerapporteerd die voortkomen uit het ontbreken van noodzakelijke autorisatiecontroles, wat kan resulteren in ongeoorloofde toegang tot gevoelige gegevens en privilege-escalatie.
SAP brengt de kwetsbaarheid met kenmerk CVE-2025-31324 opnieuw onder de aandacht. Deze kwetsbaarheid bevindt zich in de NetWeaver Visual Component en is in de maandelijkse update van april verholpen. Deze kwetsbaarheid is echter als ZeroDay actief misbruikt.
Oplossingen
SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-141
Improper Neutralization of Parameter/Argument Delimiters
CWE-749
Exposed Dangerous Method or Function
CWE-472
External Control of Assumed-Immutable Web Parameter
CWE-732
Incorrect Permission Assignment for Critical Resource
CWE-256
Plaintext Storage of a Password
CWE-434
Unrestricted Upload of File with Dangerous Type
CWE-285
Improper Authorization
CWE-862
Missing Authorization
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-502
Deserialization of Untrusted Data
CWE-611
Improper Restriction of XML External Entity Reference
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "SAP heeft meerdere kwetsbaarheden verholpen in diverse SAP producten, zoals NetWeaver, NetWeaver Visual Composer, SAP GUI, pcde, Business Objects, HANA en andere componenten.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden omvatten onder andere een onbeperkte bestandsuploadfout die ongeauthenticeerde gebruikers in staat stelt om kwaadaardige bestanden te uploaden, wat kan leiden tot uitvoer van willekeurige code. Daarnaast zijn er kwetsbaarheden gerapporteerd die voortkomen uit het ontbreken van noodzakelijke autorisatiecontroles, wat kan resulteren in ongeoorloofde toegang tot gevoelige gegevens en privilege-escalatie.\n\nSAP brengt de kwetsbaarheid met kenmerk CVE-2025-31324 opnieuw onder de aandacht. Deze kwetsbaarheid bevindt zich in de NetWeaver Visual Component en is in de maandelijkse update van april verholpen. Deze kwetsbaarheid is echter als ZeroDay actief misbruikt.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Neutralization of Parameter/Argument Delimiters",
"title": "CWE-141"
},
{
"category": "general",
"text": "Exposed Dangerous Method or Function",
"title": "CWE-749"
},
{
"category": "general",
"text": "External Control of Assumed-Immutable Web Parameter",
"title": "CWE-472"
},
{
"category": "general",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "general",
"text": "Plaintext Storage of a Password",
"title": "CWE-256"
},
{
"category": "general",
"text": "Unrestricted Upload of File with Dangerous Type",
"title": "CWE-434"
},
{
"category": "general",
"text": "Improper Authorization",
"title": "CWE-285"
},
{
"category": "general",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "general",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Improper Restriction of XML External Entity Reference",
"title": "CWE-611"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Source - sap",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2025.html"
}
],
"title": "Kwetsbaarheden verholpen in SAP producten",
"tracking": {
"current_release_date": "2025-05-13T09:05:38.110295Z",
"generator": {
"date": "2025-02-25T15:15:00Z",
"engine": {
"name": "V.A.",
"version": "1.0"
}
},
"id": "NCSC-2025-0149",
"initial_release_date": "2025-05-13T09:05:38.110295Z",
"revision_history": [
{
"date": "2025-05-13T09:05:38.110295Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:sap/7.50 for visual composer development server",
"product": {
"name": "vers:sap/7.50 for visual composer development server",
"product_id": "CSAFPID-2773833"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/7.50",
"product": {
"name": "vers:unknown/7.50",
"product_id": "CSAFPID-1601553"
}
}
],
"category": "product_name",
"name": "Netweaver"
}
],
"category": "product_family",
"name": "SAP"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/2025",
"product": {
"name": "vers:unknown/2025",
"product_id": "CSAFPID-2832358"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/2027",
"product": {
"name": "vers:unknown/2027",
"product_id": "CSAFPID-2832359"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/enterprise430",
"product": {
"name": "vers:unknown/enterprise430",
"product_id": "CSAFPID-2832357"
}
}
],
"category": "product_name",
"name": "SAP Business Objects Business Intelligence Platform (PMW)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/sbopdsjobserver4.3",
"product": {
"name": "vers:unknown/sbopdsjobserver4.3",
"product_id": "CSAFPID-2832331"
}
}
],
"category": "product_name",
"name": "SAP Data Services Management Console"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/unknown",
"product": {
"name": "vers:unknown/unknown",
"product_id": "CSAFPID-1333259"
}
}
],
"category": "product_name",
"name": "NetWeaver"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/ctnr-dme-podfoundation-ms1.0",
"product": {
"name": "vers:unknown/ctnr-dme-podfoundation-ms1.0",
"product_id": "CSAFPID-2832408"
}
}
],
"category": "product_name",
"name": "SAP Digital Manufacturing (Production Operator Dashboard)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/bc-fes-gui8.00",
"product": {
"name": "vers:unknown/bc-fes-gui8.00",
"product_id": "CSAFPID-1987640"
}
}
],
"category": "product_name",
"name": "SAP GUI for Windows"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/756",
"product": {
"name": "vers:unknown/756",
"product_id": "CSAFPID-2832390"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/757",
"product": {
"name": "vers:unknown/757",
"product_id": "CSAFPID-2832391"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/758",
"product": {
"name": "vers:unknown/758",
"product_id": "CSAFPID-2832392"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_gwfnd752",
"product": {
"name": "vers:unknown/sap_gwfnd752",
"product_id": "CSAFPID-2832386"
}
}
],
"category": "product_name",
"name": "SAP Gateway Client"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/106",
"product": {
"name": "vers:unknown/106",
"product_id": "CSAFPID-2832370"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/107",
"product": {
"name": "vers:unknown/107",
"product_id": "CSAFPID-2832371"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/108",
"product": {
"name": "vers:unknown/108",
"product_id": "CSAFPID-2832372"
}
}
],
"category": "product_name",
"name": "SAP Landscape Transformation (PCL Basis)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/vcframework7.50",
"product": {
"name": "vers:unknown/vcframework7.50",
"product_id": "CSAFPID-2770954"
}
}
],
"category": "product_name",
"name": "SAP NetWeaver (Visual Composer development server)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis756",
"product": {
"name": "vers:unknown/sap_basis756",
"product_id": "CSAFPID-2832405"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis757",
"product": {
"name": "vers:unknown/sap_basis757",
"product_id": "CSAFPID-2832406"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis758",
"product": {
"name": "vers:unknown/sap_basis758",
"product_id": "CSAFPID-2832407"
}
}
],
"category": "product_name",
"name": "SAP NetWeaver Application Server ABAP and ABAP Platform"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/712",
"product": {
"name": "vers:unknown/712",
"product_id": "CSAFPID-2832354"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/713",
"product": {
"name": "vers:unknown/713",
"product_id": "CSAFPID-2832355"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/714",
"product": {
"name": "vers:unknown/714",
"product_id": "CSAFPID-2832356"
}
}
],
"category": "product_name",
"name": "SAP S/4HANA (Private Cloud \u0026 On-Premise)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/712",
"product": {
"name": "vers:unknown/712",
"product_id": "CSAFPID-2832383"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/713",
"product": {
"name": "vers:unknown/713",
"product_id": "CSAFPID-2832384"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/714",
"product": {
"name": "vers:unknown/714",
"product_id": "CSAFPID-2832385"
}
}
],
"category": "product_name",
"name": "SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL))"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/604",
"product": {
"name": "vers:unknown/604",
"product_id": "CSAFPID-2832419"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/608",
"product": {
"name": "vers:unknown/608",
"product_id": "CSAFPID-2832420"
}
}
],
"category": "product_name",
"name": "SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/104",
"product": {
"name": "vers:unknown/104",
"product_id": "CSAFPID-2832345"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/105",
"product": {
"name": "vers:unknown/105",
"product_id": "CSAFPID-2832346"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/106",
"product": {
"name": "vers:unknown/106",
"product_id": "CSAFPID-2832347"
}
}
],
"category": "product_name",
"name": "SAP S4/HANA (OData meta-data property)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/616",
"product": {
"name": "vers:unknown/616",
"product_id": "CSAFPID-2832427"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/617",
"product": {
"name": "vers:unknown/617",
"product_id": "CSAFPID-2832428"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/618",
"product": {
"name": "vers:unknown/618",
"product_id": "CSAFPID-2832411"
}
}
],
"category": "product_name",
"name": "SAP Service Parts Management (SPM)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1298148",
"product_identification_helper": {
"cpe": "cpe:/a:sap:sap:-"
}
}
}
],
"category": "product_name",
"name": "SAP Software"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/srm_server7.14",
"product": {
"name": "vers:unknown/srm_server7.14",
"product_id": "CSAFPID-2832338"
}
}
],
"category": "product_name",
"name": "SAP Supplier Relationship Management (Live Auction Cockpit)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/srm_mdm_cat7.52",
"product": {
"name": "vers:unknown/srm_mdm_cat7.52",
"product_id": "CSAFPID-1987658"
}
}
],
"category": "product_name",
"name": "SAP Supplier Relationship Management (Master Data Management Catalog)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/7.50",
"product": {
"name": "vers:unknown/7.50",
"product_id": "CSAFPID-1989115"
}
}
],
"category": "product_name",
"name": "netweaver"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/s4core_103",
"product": {
"name": "vers:unknown/s4core_103",
"product_id": "CSAFPID-1111426"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4coreop_104",
"product": {
"name": "vers:unknown/s4coreop_104",
"product_id": "CSAFPID-1111430"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4coreop_105",
"product": {
"name": "vers:unknown/s4coreop_105",
"product_id": "CSAFPID-1111425"
}
}
],
"category": "product_name",
"name": "pdce"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-180357",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:sap:-:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "sap"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/108",
"product": {
"name": "vers:unknown/108",
"product_id": "CSAFPID-1111423",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:s4coreop:108:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_version_range",
"name": "vers:unknown/107",
"product": {
"name": "vers:unknown/107",
"product_id": "CSAFPID-1111422",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:s4coreop:107:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_version_range",
"name": "vers:unknown/106",
"product": {
"name": "vers:unknown/106",
"product_id": "CSAFPID-1111421",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:s4coreop:106:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "s4coreop"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/s4core_102",
"product": {
"name": "vers:unknown/s4core_102",
"product_id": "CSAFPID-1111412",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_pdce:s4core_102:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "sap_pdce"
}
],
"category": "vendor",
"name": "SAP"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-42999",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-42999",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-42999.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-42999"
},
{
"cve": "CVE-2025-30018",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"notes": [
{
"category": "other",
"text": "Improper Restriction of XML External Entity Reference",
"title": "CWE-611"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30018",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30018.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-30018"
},
{
"cve": "CVE-2025-43010",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43010",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43010.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43010"
},
{
"cve": "CVE-2025-43000",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43000",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43000.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43000"
},
{
"cve": "CVE-2025-43011",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43011",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43011.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43011"
},
{
"cve": "CVE-2024-39592",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-39592",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39592.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2024-39592"
},
{
"cve": "CVE-2025-42997",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "other",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-42997",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-42997.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-42997"
},
{
"cve": "CVE-2025-43003",
"cwe": {
"id": "CWE-749",
"name": "Exposed Dangerous Method or Function"
},
"notes": [
{
"category": "other",
"text": "Exposed Dangerous Method or Function",
"title": "CWE-749"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43003",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43003.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43003"
},
{
"cve": "CVE-2025-43009",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43009",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43009.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43009"
},
{
"cve": "CVE-2025-43007",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43007",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43007.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43007"
},
{
"cve": "CVE-2025-31329",
"cwe": {
"id": "CWE-141",
"name": "Improper Neutralization of Parameter/Argument Delimiters"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Parameter/Argument Delimiters",
"title": "CWE-141"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31329",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31329.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-31329"
},
{
"cve": "CVE-2025-43006",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43006",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43006.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43006"
},
{
"cve": "CVE-2025-43008",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43008",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43008.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43008"
},
{
"cve": "CVE-2025-43004",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43004",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43004.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43004"
},
{
"cve": "CVE-2025-26662",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-26662",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-26662.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-26662"
},
{
"cve": "CVE-2025-43002",
"cwe": {
"id": "CWE-472",
"name": "External Control of Assumed-Immutable Web Parameter"
},
"notes": [
{
"category": "other",
"text": "External Control of Assumed-Immutable Web Parameter",
"title": "CWE-472"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43002",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43002.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43002"
},
{
"cve": "CVE-2025-43005",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"notes": [
{
"category": "other",
"text": "Plaintext Storage of a Password",
"title": "CWE-256"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43005",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43005.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43005"
},
{
"cve": "CVE-2025-31324",
"cwe": {
"id": "CWE-434",
"name": "Unrestricted Upload of File with Dangerous Type"
},
"notes": [
{
"category": "other",
"text": "Unrestricted Upload of File with Dangerous Type",
"title": "CWE-434"
},
{
"category": "other",
"text": "Improper Authorization",
"title": "CWE-285"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31324",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31324.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-31324"
}
]
}
ncsc-2025-0076
Vulnerability from csaf_ncscnl
Published
2025-03-11 12:20
Modified
2025-03-11 12:20
Summary
Kwetsbaarheden verholpen in SAP software
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
SAP heeft meerdere kwetsbaarheden verholpen in zijn softwarecomponenten, waaronder SAP Commerce, SAP NetWeaver, en SAP BusinessObjects.
Interpretaties
De kwetsbaarheden omvatten onder andere Cross-Site Scripting (XSS) en ontbrekende autorisatiecontroles, die aanvallers in staat stellen om ongeautoriseerde toegang te verkrijgen, gegevens te manipuleren en gevoelige informatie te onthullen. Deze kwetsbaarheden kunnen leiden tot ernstige gevolgen voor de integriteit en vertrouwelijkheid van de gegevens binnen de getroffen systemen. Specifieke kwetsbaarheden zijn onder andere het ontbreken van essentiële autorisatiecontroles in SAP NetWeaver en de mogelijkheid voor aanvallers om sessies te stelen via de SAP Approuter Node.js package.
Oplossingen
SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen, waaronder 21 beveiligingspatches voor de SAP Approuter en andere kritieke kwetsbaarheden. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-302
Authentication Bypass by Assumed-Immutable Data
CWE-1287
Improper Validation of Specified Type of Input
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
CWE-532
Insertion of Sensitive Information into Log File
CWE-639
Authorization Bypass Through User-Controlled Key
CWE-306
Missing Authentication for Critical Function
CWE-862
Missing Authorization
CWE-400
Uncontrolled Resource Consumption
CWE-770
Allocation of Resources Without Limits or Throttling
CWE-918
Server-Side Request Forgery (SSRF)
CWE-384
Session Fixation
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-209
Generation of Error Message Containing Sensitive Information
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "SAP heeft meerdere kwetsbaarheden verholpen in zijn softwarecomponenten, waaronder SAP Commerce, SAP NetWeaver, en SAP BusinessObjects.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden omvatten onder andere Cross-Site Scripting (XSS) en ontbrekende autorisatiecontroles, die aanvallers in staat stellen om ongeautoriseerde toegang te verkrijgen, gegevens te manipuleren en gevoelige informatie te onthullen. Deze kwetsbaarheden kunnen leiden tot ernstige gevolgen voor de integriteit en vertrouwelijkheid van de gegevens binnen de getroffen systemen. Specifieke kwetsbaarheden zijn onder andere het ontbreken van essenti\u00eble autorisatiecontroles in SAP NetWeaver en de mogelijkheid voor aanvallers om sessies te stelen via de SAP Approuter Node.js package.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen, waaronder 21 beveiligingspatches voor de SAP Approuter en andere kritieke kwetsbaarheden. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Authentication Bypass by Assumed-Immutable Data",
"title": "CWE-302"
},
{
"category": "general",
"text": "Improper Validation of Specified Type of Input",
"title": "CWE-1287"
},
{
"category": "general",
"text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"title": "CWE-601"
},
{
"category": "general",
"text": "Insertion of Sensitive Information into Log File",
"title": "CWE-532"
},
{
"category": "general",
"text": "Authorization Bypass Through User-Controlled Key",
"title": "CWE-639"
},
{
"category": "general",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
},
{
"category": "general",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
},
{
"category": "general",
"text": "Session Fixation",
"title": "CWE-384"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "Generation of Error Message Containing Sensitive Information",
"title": "CWE-209"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Source - sap",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2025.html"
}
],
"title": "Kwetsbaarheden verholpen in SAP software",
"tracking": {
"current_release_date": "2025-03-11T12:20:06.258896Z",
"generator": {
"date": "2025-02-25T15:15:00Z",
"engine": {
"name": "V.A.",
"version": "1.0"
}
},
"id": "NCSC-2025-0076",
"initial_release_date": "2025-03-11T12:20:06.258896Z",
"revision_history": [
{
"date": "2025-03-11T12:20:06.258896Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1298148",
"product_identification_helper": {
"cpe": "cpe:/a:sap:sap:-"
}
}
}
],
"category": "product_name",
"name": "SAP Software"
}
],
"category": "vendor",
"name": "SAP"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/com_cloud2211",
"product": {
"name": "vers:unknown/com_cloud2211",
"product_id": "CSAFPID-2455751"
}
}
],
"category": "product_name",
"name": "SAP Commerce (Swagger UI)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis700",
"product": {
"name": "vers:unknown/sap_basis700",
"product_id": "CSAFPID-2455822"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis701",
"product": {
"name": "vers:unknown/sap_basis701",
"product_id": "CSAFPID-2455823"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis702",
"product": {
"name": "vers:unknown/sap_basis702",
"product_id": "CSAFPID-2455824"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis731",
"product": {
"name": "vers:unknown/sap_basis731",
"product_id": "CSAFPID-2455825"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis740",
"product": {
"name": "vers:unknown/sap_basis740",
"product_id": "CSAFPID-2455826"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis750",
"product": {
"name": "vers:unknown/sap_basis750",
"product_id": "CSAFPID-2455827"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis751",
"product": {
"name": "vers:unknown/sap_basis751",
"product_id": "CSAFPID-2455828"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis752",
"product": {
"name": "vers:unknown/sap_basis752",
"product_id": "CSAFPID-2455829"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis753",
"product": {
"name": "vers:unknown/sap_basis753",
"product_id": "CSAFPID-2455830"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis754",
"product": {
"name": "vers:unknown/sap_basis754",
"product_id": "CSAFPID-2455831"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis755",
"product": {
"name": "vers:unknown/sap_basis755",
"product_id": "CSAFPID-2455832"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis756",
"product": {
"name": "vers:unknown/sap_basis756",
"product_id": "CSAFPID-2455833"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis757",
"product": {
"name": "vers:unknown/sap_basis757",
"product_id": "CSAFPID-2455834"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis758",
"product": {
"name": "vers:unknown/sap_basis758",
"product_id": "CSAFPID-2455835"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis914",
"product": {
"name": "vers:unknown/sap_basis914",
"product_id": "CSAFPID-2455836"
}
}
],
"category": "product_name",
"name": "SAP NetWeaver (ABAP Class Builder)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/2.6.1to16.7.1",
"product": {
"name": "vers:unknown/2.6.1to16.7.1",
"product_id": "CSAFPID-1987654"
}
}
],
"category": "product_name",
"name": "SAP Approuter Node.js package"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/b1_on_hana10.0",
"product": {
"name": "vers:unknown/b1_on_hana10.0",
"product_id": "CSAFPID-2455809"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap-m-bo10.0",
"product": {
"name": "vers:unknown/sap-m-bo10.0",
"product_id": "CSAFPID-2455810"
}
}
],
"category": "product_name",
"name": "SAP Business One (Service Layer)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/dw4core100",
"product": {
"name": "vers:unknown/dw4core100",
"product_id": "CSAFPID-2455779"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_bw730",
"product": {
"name": "vers:unknown/sap_bw730",
"product_id": "CSAFPID-2455784"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/200",
"product": {
"name": "vers:unknown/200",
"product_id": "CSAFPID-2455780"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/300",
"product": {
"name": "vers:unknown/300",
"product_id": "CSAFPID-2455781"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/400",
"product": {
"name": "vers:unknown/400",
"product_id": "CSAFPID-2455782"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/731",
"product": {
"name": "vers:unknown/731",
"product_id": "CSAFPID-2455785"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/740",
"product": {
"name": "vers:unknown/740",
"product_id": "CSAFPID-2455786"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/750",
"product": {
"name": "vers:unknown/750",
"product_id": "CSAFPID-2455787"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/751",
"product": {
"name": "vers:unknown/751",
"product_id": "CSAFPID-2455788"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/752",
"product": {
"name": "vers:unknown/752",
"product_id": "CSAFPID-2455789"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/753",
"product": {
"name": "vers:unknown/753",
"product_id": "CSAFPID-2455790"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/754",
"product": {
"name": "vers:unknown/754",
"product_id": "CSAFPID-2455791"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/755",
"product": {
"name": "vers:unknown/755",
"product_id": "CSAFPID-2455792"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/756",
"product": {
"name": "vers:unknown/756",
"product_id": "CSAFPID-2455793"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/757",
"product": {
"name": "vers:unknown/757",
"product_id": "CSAFPID-2455794"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/758",
"product": {
"name": "vers:unknown/758",
"product_id": "CSAFPID-2455795"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/914",
"product": {
"name": "vers:unknown/914",
"product_id": "CSAFPID-2455783"
}
}
],
"category": "product_name",
"name": "SAP Business Warehouse (Process Chains)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/7.54",
"product": {
"name": "vers:unknown/7.54",
"product_id": "CSAFPID-2455756"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/7.77",
"product": {
"name": "vers:unknown/7.77",
"product_id": "CSAFPID-2455757"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/7.89",
"product": {
"name": "vers:unknown/7.89",
"product_id": "CSAFPID-2455758"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/7.93",
"product": {
"name": "vers:unknown/7.93",
"product_id": "CSAFPID-2455759"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/9.14",
"product": {
"name": "vers:unknown/9.14",
"product_id": "CSAFPID-2455761"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/kernel7.53",
"product": {
"name": "vers:unknown/kernel7.53",
"product_id": "CSAFPID-2455760"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/krnl64uc7.53",
"product": {
"name": "vers:unknown/krnl64uc7.53",
"product_id": "CSAFPID-2455754"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/webdisp7.53",
"product": {
"name": "vers:unknown/webdisp7.53",
"product_id": "CSAFPID-2455755"
}
}
],
"category": "product_name",
"name": "SAP Web Dispatcher and Internet Communication Manager"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/2025",
"product": {
"name": "vers:unknown/2025",
"product_id": "CSAFPID-2455797"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/enterprise430",
"product": {
"name": "vers:unknown/enterprise430",
"product_id": "CSAFPID-2455796"
}
}
],
"category": "product_name",
"name": "SAP BusinessObjects Business Intelligence Platform (Web Intelligence)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/108",
"product": {
"name": "vers:unknown/108",
"product_id": "CSAFPID-2455763"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4core107",
"product": {
"name": "vers:unknown/s4core107",
"product_id": "CSAFPID-2455762"
}
}
],
"category": "product_name",
"name": "SAP S/4HANA (Manage Bank Statements)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/103",
"product": {
"name": "vers:unknown/103",
"product_id": "CSAFPID-2455770"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/104",
"product": {
"name": "vers:unknown/104",
"product_id": "CSAFPID-2455771"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/105",
"product": {
"name": "vers:unknown/105",
"product_id": "CSAFPID-2455772"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/106",
"product": {
"name": "vers:unknown/106",
"product_id": "CSAFPID-2455773"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/107",
"product": {
"name": "vers:unknown/107",
"product_id": "CSAFPID-2455774"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/108",
"product": {
"name": "vers:unknown/108",
"product_id": "CSAFPID-2455775"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/ea-finserv618",
"product": {
"name": "vers:unknown/ea-finserv618",
"product_id": "CSAFPID-2455776"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/ea-finserv800",
"product": {
"name": "vers:unknown/ea-finserv800",
"product_id": "CSAFPID-2455777"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4core102",
"product": {
"name": "vers:unknown/s4core102",
"product_id": "CSAFPID-2455769"
}
}
],
"category": "product_name",
"name": "SAP S/4HANA (RBD)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/104",
"product": {
"name": "vers:unknown/104",
"product_id": "CSAFPID-2455817"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/105",
"product": {
"name": "vers:unknown/105",
"product_id": "CSAFPID-2455818"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/106",
"product": {
"name": "vers:unknown/106",
"product_id": "CSAFPID-2455819"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/107",
"product": {
"name": "vers:unknown/107",
"product_id": "CSAFPID-2455820"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/108",
"product": {
"name": "vers:unknown/108",
"product_id": "CSAFPID-2455821"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4core103",
"product": {
"name": "vers:unknown/s4core103",
"product_id": "CSAFPID-2455816"
}
}
],
"category": "product_name",
"name": "SAP Fiori apps (Posting Library)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/106",
"product": {
"name": "vers:unknown/106",
"product_id": "CSAFPID-2455806"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/107",
"product": {
"name": "vers:unknown/107",
"product_id": "CSAFPID-2455807"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/108",
"product": {
"name": "vers:unknown/108",
"product_id": "CSAFPID-2455808"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4core105",
"product": {
"name": "vers:unknown/s4core105",
"product_id": "CSAFPID-2455805"
}
}
],
"category": "product_name",
"name": "S/4HANA (Manage Purchasing Info Records)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/2025",
"product": {
"name": "vers:unknown/2025",
"product_id": "CSAFPID-2455765"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/2027",
"product": {
"name": "vers:unknown/2027",
"product_id": "CSAFPID-2455766"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/enterprise430",
"product": {
"name": "vers:unknown/enterprise430",
"product_id": "CSAFPID-2455764"
}
}
],
"category": "product_name",
"name": "SAP Business Objects Business Intelligence Platform"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/2025",
"product": {
"name": "vers:unknown/2025",
"product_id": "CSAFPID-1425566"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/enterprise430",
"product": {
"name": "vers:unknown/enterprise430",
"product_id": "CSAFPID-1425565"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/enterpriseclienttools430",
"product": {
"name": "vers:unknown/enterpriseclienttools430",
"product_id": "CSAFPID-2455753"
}
}
],
"category": "product_name",
"name": "SAP BusinessObjects Business Intelligence Platform"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/103",
"product": {
"name": "vers:unknown/103",
"product_id": "CSAFPID-2455843"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/104",
"product": {
"name": "vers:unknown/104",
"product_id": "CSAFPID-2455844"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/105",
"product": {
"name": "vers:unknown/105",
"product_id": "CSAFPID-2455845"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/106",
"product": {
"name": "vers:unknown/106",
"product_id": "CSAFPID-2455846"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/107",
"product": {
"name": "vers:unknown/107",
"product_id": "CSAFPID-2455847"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/108",
"product": {
"name": "vers:unknown/108",
"product_id": "CSAFPID-2455848"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/200",
"product": {
"name": "vers:unknown/200",
"product_id": "CSAFPID-2455838"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/204",
"product": {
"name": "vers:unknown/204",
"product_id": "CSAFPID-2455839"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/205",
"product": {
"name": "vers:unknown/205",
"product_id": "CSAFPID-2455840"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/206",
"product": {
"name": "vers:unknown/206",
"product_id": "CSAFPID-2455841"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/702",
"product": {
"name": "vers:unknown/702",
"product_id": "CSAFPID-2455851"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/712",
"product": {
"name": "vers:unknown/712",
"product_id": "CSAFPID-2455852"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/713",
"product": {
"name": "vers:unknown/713",
"product_id": "CSAFPID-2455853"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/714",
"product": {
"name": "vers:unknown/714",
"product_id": "CSAFPID-2455854"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/731",
"product": {
"name": "vers:unknown/731",
"product_id": "CSAFPID-2455856"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/746",
"product": {
"name": "vers:unknown/746",
"product_id": "CSAFPID-2455857"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/747",
"product": {
"name": "vers:unknown/747",
"product_id": "CSAFPID-2455858"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/748",
"product": {
"name": "vers:unknown/748",
"product_id": "CSAFPID-2455859"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/800",
"product": {
"name": "vers:unknown/800",
"product_id": "CSAFPID-2455860"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/801",
"product": {
"name": "vers:unknown/801",
"product_id": "CSAFPID-2455861"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/bbpcrm701",
"product": {
"name": "vers:unknown/bbpcrm701",
"product_id": "CSAFPID-2455850"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4cext107",
"product": {
"name": "vers:unknown/s4cext107",
"product_id": "CSAFPID-2455849"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4crm100",
"product": {
"name": "vers:unknown/s4crm100",
"product_id": "CSAFPID-2455837"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4fnd102",
"product": {
"name": "vers:unknown/s4fnd102",
"product_id": "CSAFPID-2455842"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/webcuif701",
"product": {
"name": "vers:unknown/webcuif701",
"product_id": "CSAFPID-2455855"
}
}
],
"category": "product_name",
"name": "SAP CRM and SAP S/4HANA (Interaction Center)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/103",
"product": {
"name": "vers:unknown/103",
"product_id": "CSAFPID-2455865"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/104",
"product": {
"name": "vers:unknown/104",
"product_id": "CSAFPID-2455866"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/105",
"product": {
"name": "vers:unknown/105",
"product_id": "CSAFPID-2455867"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/106",
"product": {
"name": "vers:unknown/106",
"product_id": "CSAFPID-2455868"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/107",
"product": {
"name": "vers:unknown/107",
"product_id": "CSAFPID-2455869"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/108",
"product": {
"name": "vers:unknown/108",
"product_id": "CSAFPID-2455870"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/618",
"product": {
"name": "vers:unknown/618",
"product_id": "CSAFPID-2455863"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4core102",
"product": {
"name": "vers:unknown/s4core102",
"product_id": "CSAFPID-2455864"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_appl617",
"product": {
"name": "vers:unknown/sap_appl617",
"product_id": "CSAFPID-2455862"
}
}
],
"category": "product_name",
"name": "SAP Electronic Invoicing for Brazil (eDocument Cockpit)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/103",
"product": {
"name": "vers:unknown/103",
"product_id": "CSAFPID-2455799"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/104",
"product": {
"name": "vers:unknown/104",
"product_id": "CSAFPID-2455800"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/105",
"product": {
"name": "vers:unknown/105",
"product_id": "CSAFPID-2455801"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/106",
"product": {
"name": "vers:unknown/106",
"product_id": "CSAFPID-2455802"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/107",
"product": {
"name": "vers:unknown/107",
"product_id": "CSAFPID-2455803"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/ecc-dimp618",
"product": {
"name": "vers:unknown/ecc-dimp618",
"product_id": "CSAFPID-2455804"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4core102",
"product": {
"name": "vers:unknown/s4core102",
"product_id": "CSAFPID-2455798"
}
}
],
"category": "product_name",
"name": "SAP Just In Time"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis740",
"product": {
"name": "vers:unknown/sap_basis740",
"product_id": "CSAFPID-1761541"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis750",
"product": {
"name": "vers:unknown/sap_basis750",
"product_id": "CSAFPID-1761542"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis751",
"product": {
"name": "vers:unknown/sap_basis751",
"product_id": "CSAFPID-1761543"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis752",
"product": {
"name": "vers:unknown/sap_basis752",
"product_id": "CSAFPID-1761544"
}
}
],
"category": "product_name",
"name": "SAP NetWeaver Application Server ABAP"
}
],
"category": "vendor",
"name": "SAP_SE"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-27434",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-27434",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-27434.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-27434"
},
{
"cve": "CVE-2025-26661",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-26661",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-26661.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-26661"
},
{
"cve": "CVE-2024-38286",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-38286",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38286.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2024-38286"
},
{
"cve": "CVE-2025-24876",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"notes": [
{
"category": "other",
"text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"title": "CWE-601"
},
{
"category": "other",
"text": "Improper Validation of Specified Type of Input",
"title": "CWE-1287"
},
{
"category": "other",
"text": "Authentication Bypass by Assumed-Immutable Data",
"title": "CWE-302"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24876",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24876.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-24876"
},
{
"cve": "CVE-2024-39592",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-39592",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39592.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2024-39592"
},
{
"cve": "CVE-2025-26658",
"cwe": {
"id": "CWE-384",
"name": "Session Fixation"
},
"notes": [
{
"category": "other",
"text": "Session Fixation",
"title": "CWE-384"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-26658",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-26658.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-26658"
},
{
"cve": "CVE-2025-26659",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-26659",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-26659.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-26659"
},
{
"cve": "CVE-2025-25242",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-25242",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-25242.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-25242"
},
{
"cve": "CVE-2025-25244",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-25244",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-25244.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-25244"
},
{
"cve": "CVE-2025-27431",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-27431",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-27431.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-27431"
},
{
"cve": "CVE-2025-25245",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-25245",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-25245.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-25245"
},
{
"cve": "CVE-2025-23194",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"category": "other",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-23194",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-23194.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-23194"
},
{
"cve": "CVE-2025-0071",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"notes": [
{
"category": "other",
"text": "Insertion of Sensitive Information into Log File",
"title": "CWE-532"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-0071",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-0071.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-0071"
},
{
"cve": "CVE-2025-0062",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-0062",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-0062.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-0062"
},
{
"cve": "CVE-2025-27433",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"notes": [
{
"category": "other",
"text": "Authorization Bypass Through User-Controlled Key",
"title": "CWE-639"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-27433",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-27433.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-27433"
},
{
"cve": "CVE-2025-23188",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-23188",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-23188.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-23188"
},
{
"cve": "CVE-2025-26660",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"notes": [
{
"category": "other",
"text": "Authorization Bypass Through User-Controlled Key",
"title": "CWE-639"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-26660",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-26660.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-26660"
},
{
"cve": "CVE-2025-26656",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-26656",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-26656.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-26656"
},
{
"cve": "CVE-2024-41736",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-41736",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41736.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2024-41736"
},
{
"cve": "CVE-2025-23185",
"cwe": {
"id": "CWE-209",
"name": "Generation of Error Message Containing Sensitive Information"
},
"notes": [
{
"category": "other",
"text": "Generation of Error Message Containing Sensitive Information",
"title": "CWE-209"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-23185",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-23185.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-23185"
},
{
"cve": "CVE-2024-38819",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-38819",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38819.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2024-38819"
},
{
"cve": "CVE-2025-27430",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "other",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-27430",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-27430.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-27430"
},
{
"cve": "CVE-2025-26655",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-26655",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-26655.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-26655"
},
{
"cve": "CVE-2025-27432",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-27432",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-27432.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1298148",
"CSAFPID-2455751",
"CSAFPID-2455822",
"CSAFPID-2455823",
"CSAFPID-2455824",
"CSAFPID-2455825",
"CSAFPID-2455826",
"CSAFPID-2455827",
"CSAFPID-2455828",
"CSAFPID-2455829",
"CSAFPID-2455830",
"CSAFPID-2455831",
"CSAFPID-2455832",
"CSAFPID-2455833",
"CSAFPID-2455834",
"CSAFPID-2455835",
"CSAFPID-2455836",
"CSAFPID-1987654",
"CSAFPID-2455809",
"CSAFPID-2455810",
"CSAFPID-2455779",
"CSAFPID-2455756",
"CSAFPID-2455757",
"CSAFPID-2455758",
"CSAFPID-2455759",
"CSAFPID-2455761",
"CSAFPID-2455760",
"CSAFPID-2455754",
"CSAFPID-2455755",
"CSAFPID-2455797",
"CSAFPID-2455796",
"CSAFPID-2455763",
"CSAFPID-2455762",
"CSAFPID-2455770",
"CSAFPID-2455771",
"CSAFPID-2455772",
"CSAFPID-2455773",
"CSAFPID-2455774",
"CSAFPID-2455775",
"CSAFPID-2455776",
"CSAFPID-2455777",
"CSAFPID-2455769",
"CSAFPID-2455817",
"CSAFPID-2455818",
"CSAFPID-2455819",
"CSAFPID-2455820",
"CSAFPID-2455821",
"CSAFPID-2455816",
"CSAFPID-2455806",
"CSAFPID-2455807",
"CSAFPID-2455808",
"CSAFPID-2455805",
"CSAFPID-2455765",
"CSAFPID-2455766",
"CSAFPID-2455764",
"CSAFPID-1425566",
"CSAFPID-1425565",
"CSAFPID-2455753",
"CSAFPID-2455784",
"CSAFPID-2455780",
"CSAFPID-2455781",
"CSAFPID-2455782",
"CSAFPID-2455785",
"CSAFPID-2455786",
"CSAFPID-2455787",
"CSAFPID-2455788",
"CSAFPID-2455789",
"CSAFPID-2455790",
"CSAFPID-2455791",
"CSAFPID-2455792",
"CSAFPID-2455793",
"CSAFPID-2455794",
"CSAFPID-2455795",
"CSAFPID-2455783",
"CSAFPID-2455843",
"CSAFPID-2455844",
"CSAFPID-2455845",
"CSAFPID-2455846",
"CSAFPID-2455847",
"CSAFPID-2455848",
"CSAFPID-2455838",
"CSAFPID-2455839",
"CSAFPID-2455840",
"CSAFPID-2455841",
"CSAFPID-2455851",
"CSAFPID-2455852",
"CSAFPID-2455853",
"CSAFPID-2455854",
"CSAFPID-2455856",
"CSAFPID-2455857",
"CSAFPID-2455858",
"CSAFPID-2455859",
"CSAFPID-2455860",
"CSAFPID-2455861",
"CSAFPID-2455850",
"CSAFPID-2455849",
"CSAFPID-2455837",
"CSAFPID-2455842",
"CSAFPID-2455855",
"CSAFPID-2455865",
"CSAFPID-2455866",
"CSAFPID-2455867",
"CSAFPID-2455868",
"CSAFPID-2455869",
"CSAFPID-2455870",
"CSAFPID-2455863",
"CSAFPID-2455864",
"CSAFPID-2455862",
"CSAFPID-2455799",
"CSAFPID-2455800",
"CSAFPID-2455801",
"CSAFPID-2455802",
"CSAFPID-2455803",
"CSAFPID-2455804",
"CSAFPID-2455798",
"CSAFPID-1761541",
"CSAFPID-1761542",
"CSAFPID-1761543",
"CSAFPID-1761544"
]
}
],
"title": "CVE-2025-27432"
}
]
}
wid-sec-w-2024-3093
Vulnerability from csaf_certbund
Published
2024-10-07 22:00
Modified
2024-10-07 22:00
Summary
SAP Software: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen und einen Denial-of-Service-Zustand zu erzeugen.
Betroffene Betriebssysteme
- Sonstiges
- UNIX
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "SAP stellt unternehmensweite L\u00f6sungen f\u00fcr Gesch\u00e4ftsprozesse wie Buchf\u00fchrung, Vertrieb, Einkauf und Lagerhaltung zur Verf\u00fcgung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-3093 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3093.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-3093 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3093"
},
{
"category": "external",
"summary": "SAP Security Patch Day \u2013 October 2024 vom 2024-10-07",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2024.html"
}
],
"source_lang": "en-US",
"title": "SAP Software: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2024-10-07T22:00:00.000+00:00",
"generator": {
"date": "2024-10-08T08:11:29.115+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.8"
}
},
"id": "WID-SEC-W-2024-3093",
"initial_release_date": "2024-10-07T22:00:00.000+00:00",
"revision_history": [
{
"date": "2024-10-07T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "SAP Software",
"product": {
"name": "SAP Software",
"product_id": "T038023",
"product_identification_helper": {
"cpe": "cpe:/a:sap:sap:-"
}
}
}
],
"category": "vendor",
"name": "SAP"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-23302",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2022-23302"
},
{
"cve": "CVE-2024-37179",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-37179"
},
{
"cve": "CVE-2024-37180",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-37180"
},
{
"cve": "CVE-2024-39592",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-39592"
},
{
"cve": "CVE-2024-41729",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-41729"
},
{
"cve": "CVE-2024-41730",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-41730"
},
{
"cve": "CVE-2024-42373",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-42373"
},
{
"cve": "CVE-2024-45277",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-45277"
},
{
"cve": "CVE-2024-45278",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-45278"
},
{
"cve": "CVE-2024-45282",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-45282"
},
{
"cve": "CVE-2024-45283",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-45283"
},
{
"cve": "CVE-2024-47594",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-47594"
}
]
}
WID-SEC-W-2024-3093
Vulnerability from csaf_certbund
Published
2024-10-07 22:00
Modified
2024-10-07 22:00
Summary
SAP Software: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen und einen Denial-of-Service-Zustand zu erzeugen.
Betroffene Betriebssysteme
- Sonstiges
- UNIX
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "SAP stellt unternehmensweite L\u00f6sungen f\u00fcr Gesch\u00e4ftsprozesse wie Buchf\u00fchrung, Vertrieb, Einkauf und Lagerhaltung zur Verf\u00fcgung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-3093 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3093.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-3093 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3093"
},
{
"category": "external",
"summary": "SAP Security Patch Day \u2013 October 2024 vom 2024-10-07",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2024.html"
}
],
"source_lang": "en-US",
"title": "SAP Software: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2024-10-07T22:00:00.000+00:00",
"generator": {
"date": "2024-10-08T08:11:29.115+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.8"
}
},
"id": "WID-SEC-W-2024-3093",
"initial_release_date": "2024-10-07T22:00:00.000+00:00",
"revision_history": [
{
"date": "2024-10-07T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "SAP Software",
"product": {
"name": "SAP Software",
"product_id": "T038023",
"product_identification_helper": {
"cpe": "cpe:/a:sap:sap:-"
}
}
}
],
"category": "vendor",
"name": "SAP"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-23302",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2022-23302"
},
{
"cve": "CVE-2024-37179",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-37179"
},
{
"cve": "CVE-2024-37180",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-37180"
},
{
"cve": "CVE-2024-39592",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-39592"
},
{
"cve": "CVE-2024-41729",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-41729"
},
{
"cve": "CVE-2024-41730",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-41730"
},
{
"cve": "CVE-2024-42373",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-42373"
},
{
"cve": "CVE-2024-45277",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-45277"
},
{
"cve": "CVE-2024-45278",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-45278"
},
{
"cve": "CVE-2024-45282",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-45282"
},
{
"cve": "CVE-2024-45283",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-45283"
},
{
"cve": "CVE-2024-47594",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in verschiedenen Komponenten wie NetWeaver, SAP HANA oder der BusinessObjects Business Intelligence Platform, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T038023"
]
},
"release_date": "2024-10-07T22:00:00.000+00:00",
"title": "CVE-2024-47594"
}
]
}
wid-sec-w-2024-3407
Vulnerability from csaf_certbund
Published
2024-11-11 23:00
Modified
2024-11-11 23:00
Summary
SAP Patchday November 2024: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Angriff
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuführen und beliebigen Code auszuführen.
Betroffene Betriebssysteme
- Sonstiges
- UNIX
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "SAP stellt unternehmensweite L\u00f6sungen f\u00fcr Gesch\u00e4ftsprozesse wie Buchf\u00fchrung, Vertrieb, Einkauf und Lagerhaltung zur Verf\u00fcgung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erh\u00f6hen, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-3407 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3407.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-3407 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3407"
},
{
"category": "external",
"summary": "SAP Patchday vom 2024-11-11",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2024.html"
}
],
"source_lang": "en-US",
"title": "SAP Patchday November 2024: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2024-11-11T23:00:00.000+00:00",
"generator": {
"date": "2024-11-12T11:41:22.700+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.8"
}
},
"id": "WID-SEC-W-2024-3407",
"initial_release_date": "2024-11-11T23:00:00.000+00:00",
"revision_history": [
{
"date": "2024-11-11T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "SAP Software",
"product": {
"name": "SAP Software",
"product_id": "T038912",
"product_identification_helper": {
"cpe": "cpe:/a:sap:sap:-"
}
}
}
],
"category": "vendor",
"name": "SAP"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-33000",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-33000"
},
{
"cve": "CVE-2024-39592",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-39592"
},
{
"cve": "CVE-2024-42372",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-42372"
},
{
"cve": "CVE-2024-47586",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47586"
},
{
"cve": "CVE-2024-47587",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47587"
},
{
"cve": "CVE-2024-47588",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47588"
},
{
"cve": "CVE-2024-47590",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47590"
},
{
"cve": "CVE-2024-47592",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47592"
},
{
"cve": "CVE-2024-47593",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47593"
},
{
"cve": "CVE-2024-47595",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47595"
}
]
}
WID-SEC-W-2024-3407
Vulnerability from csaf_certbund
Published
2024-11-11 23:00
Modified
2024-11-11 23:00
Summary
SAP Patchday November 2024: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Angriff
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuführen und beliebigen Code auszuführen.
Betroffene Betriebssysteme
- Sonstiges
- UNIX
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "SAP stellt unternehmensweite L\u00f6sungen f\u00fcr Gesch\u00e4ftsprozesse wie Buchf\u00fchrung, Vertrieb, Einkauf und Lagerhaltung zur Verf\u00fcgung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erh\u00f6hen, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-3407 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3407.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-3407 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3407"
},
{
"category": "external",
"summary": "SAP Patchday vom 2024-11-11",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2024.html"
}
],
"source_lang": "en-US",
"title": "SAP Patchday November 2024: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2024-11-11T23:00:00.000+00:00",
"generator": {
"date": "2024-11-12T11:41:22.700+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.8"
}
},
"id": "WID-SEC-W-2024-3407",
"initial_release_date": "2024-11-11T23:00:00.000+00:00",
"revision_history": [
{
"date": "2024-11-11T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "SAP Software",
"product": {
"name": "SAP Software",
"product_id": "T038912",
"product_identification_helper": {
"cpe": "cpe:/a:sap:sap:-"
}
}
}
],
"category": "vendor",
"name": "SAP"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-33000",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-33000"
},
{
"cve": "CVE-2024-39592",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-39592"
},
{
"cve": "CVE-2024-42372",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-42372"
},
{
"cve": "CVE-2024-47586",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47586"
},
{
"cve": "CVE-2024-47587",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47587"
},
{
"cve": "CVE-2024-47588",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47588"
},
{
"cve": "CVE-2024-47590",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47590"
},
{
"cve": "CVE-2024-47592",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47592"
},
{
"cve": "CVE-2024-47593",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47593"
},
{
"cve": "CVE-2024-47595",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und beliebigen Code auszuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu k\u00f6nne"
}
],
"product_status": {
"known_affected": [
"T038912"
]
},
"release_date": "2024-11-11T23:00:00.000+00:00",
"title": "CVE-2024-47595"
}
]
}
cnvd-2024-49635
Vulnerability from cnvd
Title
SAP PDCE授权问题漏洞
Description
SAP PDCE是德国思爱普（SAP）公司的一种解决方案。旨在帮助企业管理和优化个人数据的整合和丰富过程。
SAP PDCE存在授权问题漏洞，该漏洞源于没有对经过身份验证的用户执行必要的授权检查，攻击者可利用该漏洞读取对应用程序机密性产生高影响的敏感信息。
Severity
中
VLAI Severity ?
Patch Name
SAP PDCE授权问题漏洞的补丁
Patch Description
SAP PDCE是德国思爱普（SAP）公司的一种解决方案。旨在帮助企业管理和优化个人数据的整合和丰富过程。
SAP PDCE存在授权问题漏洞，该漏洞源于没有对经过身份验证的用户执行必要的授权检查，攻击者可利用该漏洞读取对应用程序机密性产生高影响的敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已发布了漏洞修复程序，请及时关注更新： https://me.sap.com/notes/3483344
Reference
https://nvd.nist.gov/vuln/detail/CVE-2024-39592
Impacted products
| Name | SAP SAP PDCE |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2024-39592",
"cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-39592"
}
},
"description": "SAP PDCE\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u79cd\u89e3\u51b3\u65b9\u6848\u3002\u65e8\u5728\u5e2e\u52a9\u4f01\u4e1a\u7ba1\u7406\u548c\u4f18\u5316\u4e2a\u4eba\u6570\u636e\u7684\u6574\u5408\u548c\u4e30\u5bcc\u8fc7\u7a0b\u3002\n\nSAP PDCE\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u6ca1\u6709\u5bf9\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u7528\u6237\u6267\u884c\u5fc5\u8981\u7684\u6388\u6743\u68c0\u67e5\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u5bf9\u5e94\u7528\u7a0b\u5e8f\u673a\u5bc6\u6027\u4ea7\u751f\u9ad8\u5f71\u54cd\u7684\u654f\u611f\u4fe1\u606f\u3002",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://me.sap.com/notes/3483344",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2024-49635",
"openTime": "2024-12-30",
"patchDescription": "SAP PDCE\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u79cd\u89e3\u51b3\u65b9\u6848\u3002\u65e8\u5728\u5e2e\u52a9\u4f01\u4e1a\u7ba1\u7406\u548c\u4f18\u5316\u4e2a\u4eba\u6570\u636e\u7684\u6574\u5408\u548c\u4e30\u5bcc\u8fc7\u7a0b\u3002\r\n\r\nSAP PDCE\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u6ca1\u6709\u5bf9\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u7528\u6237\u6267\u884c\u5fc5\u8981\u7684\u6388\u6743\u68c0\u67e5\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u5bf9\u5e94\u7528\u7a0b\u5e8f\u673a\u5bc6\u6027\u4ea7\u751f\u9ad8\u5f71\u54cd\u7684\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "SAP PDCE\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "SAP SAP PDCE"
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-39592",
"serverity": "\u4e2d",
"submitTime": "2024-07-19",
"title": "SAP PDCE\u6388\u6743\u95ee\u9898\u6f0f\u6d1e"
}
fkie_cve-2024-39592
Vulnerability from fkie_nvd
Published
2024-07-09 04:15
Modified
2024-11-21 09:28
Severity ?
7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
Elements of PDCE does not perform necessary
authorization checks for an authenticated user, resulting in escalation of
privileges.
This
allows an attacker to read sensitive information causing high impact on the
confidentiality of the application.
References
| URL | Tags | ||
|---|---|---|---|
| cna@sap.com | https://me.sap.com/notes/3483344 | Permissions Required | |
| cna@sap.com | https://url.sap/sapsecuritypatchday | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://me.sap.com/notes/3483344 | Permissions Required | |
| af854a3a-2127-422b-91ae-364da2661108 | https://url.sap/sapsecuritypatchday | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*",
"matchCriteriaId": "04C95A73-48EB-446C-A5F0-20E1D6BC1779",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:*",
"matchCriteriaId": "1C3C9003-68A6-4886-8979-9B7D01A35E40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:s4coreop:104:*:*:*:*:*:*:*",
"matchCriteriaId": "666D246E-3DF3-494C-8BD6-6C2F7C0D78C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:s4coreop:105:*:*:*:*:*:*:*",
"matchCriteriaId": "D6B6F939-A3CD-4C0C-A6E7-E3BD4ADB5288",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:s4coreop:106:*:*:*:*:*:*:*",
"matchCriteriaId": "02AEDF75-D0D4-4221-BB40-9A8DC51FA84D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:s4coreop:107:*:*:*:*:*:*:*",
"matchCriteriaId": "81ABE589-A7D1-42EF-B5A9-A94C8D0AE3AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:s4coreop:108:*:*:*:*:*:*:*",
"matchCriteriaId": "7C1E9400-4CEB-4185-BC03-72B7F59DF03C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Elements of PDCE does not perform necessary\nauthorization checks for an authenticated user, resulting in escalation of\nprivileges.\n\n\n\nThis\nallows an attacker to read sensitive information causing high impact on the\nconfidentiality of the application."
},
{
"lang": "es",
"value": "Elements of PDCE no realiza las verificaciones de autorizaci\u00f3n necesarias para un usuario autenticado, lo que resulta en una escalada de privilegios. Esto permite a un atacante leer informaci\u00f3n confidencial causando un alto impacto en la confidencialidad de la aplicaci\u00f3n."
}
],
"id": "CVE-2024-39592",
"lastModified": "2024-11-21T09:28:04.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 4.0,
"source": "cna@sap.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-07-09T04:15:13.420",
"references": [
{
"source": "cna@sap.com",
"tags": [
"Permissions Required"
],
"url": "https://me.sap.com/notes/3483344"
},
{
"source": "cna@sap.com",
"tags": [
"Vendor Advisory"
],
"url": "https://url.sap/sapsecuritypatchday"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required"
],
"url": "https://me.sap.com/notes/3483344"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://url.sap/sapsecuritypatchday"
}
],
"sourceIdentifier": "cna@sap.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "cna@sap.com",
"type": "Primary"
}
]
}
ghsa-jgmc-5q6m-58ch
Vulnerability from github
Published
2024-07-09 06:30
Modified
2024-07-09 06:30
Severity ?
VLAI Severity ?
Details
Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
This allows an attacker to read sensitive information causing high impact on the confidentiality of the application.
{
"affected": [],
"aliases": [
"CVE-2024-39592"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-09T04:15:13Z",
"severity": "HIGH"
},
"details": "Elements of PDCE does not perform necessary\nauthorization checks for an authenticated user, resulting in escalation of\nprivileges.\n\n\n\nThis\nallows an attacker to read sensitive information causing high impact on the\nconfidentiality of the application.",
"id": "GHSA-jgmc-5q6m-58ch",
"modified": "2024-07-09T06:30:38Z",
"published": "2024-07-09T06:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39592"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3483344"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…