Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-42997 (GCVE-0-2025-42997)
Vulnerability from cvelistv5
Published
2025-05-13 00:17
Modified
2025-05-13 13:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Summary
Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SAP_SE | SAP Gateway Client |
Version: SAP_GWFND 752 Version: 753 Version: 754 Version: 755 Version: 756 Version: 757 Version: 758 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-42997",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-13T13:55:31.616952Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-13T13:55:38.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SAP Gateway Client",
"vendor": "SAP_SE",
"versions": [
{
"status": "affected",
"version": "SAP_GWFND 752"
},
{
"status": "affected",
"version": "753"
},
{
"status": "affected",
"version": "754"
},
{
"status": "affected",
"version": "755"
},
{
"status": "affected",
"version": "756"
},
{
"status": "affected",
"version": "757"
},
{
"status": "affected",
"version": "758"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUnder certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability.\u003c/p\u003e"
}
],
"value": "Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "eng",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-13T00:17:32.075Z",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"url": "https://me.sap.com/notes/3577300"
},
{
"url": "https://url.sap/sapsecuritypatchday"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Information Disclosure vulnerability in SAP Gateway Client",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2025-42997",
"datePublished": "2025-05-13T00:17:32.075Z",
"dateReserved": "2025-04-16T13:25:50.942Z",
"dateUpdated": "2025-05-13T13:55:38.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-42997\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2025-05-13T01:15:48.293\",\"lastModified\":\"2025-05-13T19:35:25.503\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability.\"},{\"lang\":\"es\",\"value\":\"En determinadas circunstancias, SAP Gateway Client permite a un usuario con privilegios elevados acceder a informaci\u00f3n restringida fuera del alcance de la aplicaci\u00f3n. Debido a la posibilidad de influir en el comportamiento o el rendimiento de la aplicaci\u00f3n mediante el uso indebido de los datos expuestos, esto podr\u00eda tener un impacto m\u00ednimo en la confidencialidad, la integridad y la disponibilidad.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@sap.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.3,\"impactScore\":3.7}]},\"weaknesses\":[{\"source\":\"cna@sap.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"references\":[{\"url\":\"https://me.sap.com/notes/3577300\",\"source\":\"cna@sap.com\"},{\"url\":\"https://url.sap/sapsecuritypatchday\",\"source\":\"cna@sap.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-42997\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-13T13:55:31.616952Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-13T13:55:34.702Z\"}}], \"cna\": {\"title\": \"Information Disclosure vulnerability in SAP Gateway Client\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SAP_SE\", \"product\": \"SAP Gateway Client\", \"versions\": [{\"status\": \"affected\", \"version\": \"SAP_GWFND 752\"}, {\"status\": \"affected\", \"version\": \"753\"}, {\"status\": \"affected\", \"version\": \"754\"}, {\"status\": \"affected\", \"version\": \"755\"}, {\"status\": \"affected\", \"version\": \"756\"}, {\"status\": \"affected\", \"version\": \"757\"}, {\"status\": \"affected\", \"version\": \"758\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://me.sap.com/notes/3577300\"}, {\"url\": \"https://url.sap/sapsecuritypatchday\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eUnder certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"eng\", \"type\": \"CWE\", \"cweId\": \"CWE-732\", \"description\": \"CWE-732: Incorrect Permission Assignment for Critical Resource\"}]}], \"providerMetadata\": {\"orgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"shortName\": \"sap\", \"dateUpdated\": \"2025-05-13T00:17:32.075Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-42997\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-13T13:55:38.108Z\", \"dateReserved\": \"2025-04-16T13:25:50.942Z\", \"assignerOrgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"datePublished\": \"2025-05-13T00:17:32.075Z\", \"assignerShortName\": \"sap\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
ghsa-c9j5-3rxr-ch9p
Vulnerability from github
Published
2025-05-13 03:31
Modified
2025-05-13 03:31
Severity ?
VLAI Severity ?
Details
Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability.
{
"affected": [],
"aliases": [
"CVE-2025-42997"
],
"database_specific": {
"cwe_ids": [
"CWE-732"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-13T01:15:48Z",
"severity": "MODERATE"
},
"details": "Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability.",
"id": "GHSA-c9j5-3rxr-ch9p",
"modified": "2025-05-13T03:31:14Z",
"published": "2025-05-13T03:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42997"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3577300"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
ncsc-2025-0149
Vulnerability from csaf_ncscnl
Published
2025-05-13 09:05
Modified
2025-05-13 09:05
Summary
Kwetsbaarheden verholpen in SAP producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
SAP heeft meerdere kwetsbaarheden verholpen in diverse SAP producten, zoals NetWeaver, NetWeaver Visual Composer, SAP GUI, pcde, Business Objects, HANA en andere componenten.
Interpretaties
De kwetsbaarheden omvatten onder andere een onbeperkte bestandsuploadfout die ongeauthenticeerde gebruikers in staat stelt om kwaadaardige bestanden te uploaden, wat kan leiden tot uitvoer van willekeurige code. Daarnaast zijn er kwetsbaarheden gerapporteerd die voortkomen uit het ontbreken van noodzakelijke autorisatiecontroles, wat kan resulteren in ongeoorloofde toegang tot gevoelige gegevens en privilege-escalatie.
SAP brengt de kwetsbaarheid met kenmerk CVE-2025-31324 opnieuw onder de aandacht. Deze kwetsbaarheid bevindt zich in de NetWeaver Visual Component en is in de maandelijkse update van april verholpen. Deze kwetsbaarheid is echter als ZeroDay actief misbruikt.
Oplossingen
SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-141
Improper Neutralization of Parameter/Argument Delimiters
CWE-749
Exposed Dangerous Method or Function
CWE-472
External Control of Assumed-Immutable Web Parameter
CWE-732
Incorrect Permission Assignment for Critical Resource
CWE-256
Plaintext Storage of a Password
CWE-434
Unrestricted Upload of File with Dangerous Type
CWE-285
Improper Authorization
CWE-862
Missing Authorization
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-502
Deserialization of Untrusted Data
CWE-611
Improper Restriction of XML External Entity Reference
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "SAP heeft meerdere kwetsbaarheden verholpen in diverse SAP producten, zoals NetWeaver, NetWeaver Visual Composer, SAP GUI, pcde, Business Objects, HANA en andere componenten.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden omvatten onder andere een onbeperkte bestandsuploadfout die ongeauthenticeerde gebruikers in staat stelt om kwaadaardige bestanden te uploaden, wat kan leiden tot uitvoer van willekeurige code. Daarnaast zijn er kwetsbaarheden gerapporteerd die voortkomen uit het ontbreken van noodzakelijke autorisatiecontroles, wat kan resulteren in ongeoorloofde toegang tot gevoelige gegevens en privilege-escalatie.\n\nSAP brengt de kwetsbaarheid met kenmerk CVE-2025-31324 opnieuw onder de aandacht. Deze kwetsbaarheid bevindt zich in de NetWeaver Visual Component en is in de maandelijkse update van april verholpen. Deze kwetsbaarheid is echter als ZeroDay actief misbruikt.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Neutralization of Parameter/Argument Delimiters",
"title": "CWE-141"
},
{
"category": "general",
"text": "Exposed Dangerous Method or Function",
"title": "CWE-749"
},
{
"category": "general",
"text": "External Control of Assumed-Immutable Web Parameter",
"title": "CWE-472"
},
{
"category": "general",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "general",
"text": "Plaintext Storage of a Password",
"title": "CWE-256"
},
{
"category": "general",
"text": "Unrestricted Upload of File with Dangerous Type",
"title": "CWE-434"
},
{
"category": "general",
"text": "Improper Authorization",
"title": "CWE-285"
},
{
"category": "general",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "general",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Improper Restriction of XML External Entity Reference",
"title": "CWE-611"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Source - sap",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2025.html"
}
],
"title": "Kwetsbaarheden verholpen in SAP producten",
"tracking": {
"current_release_date": "2025-05-13T09:05:38.110295Z",
"generator": {
"date": "2025-02-25T15:15:00Z",
"engine": {
"name": "V.A.",
"version": "1.0"
}
},
"id": "NCSC-2025-0149",
"initial_release_date": "2025-05-13T09:05:38.110295Z",
"revision_history": [
{
"date": "2025-05-13T09:05:38.110295Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:sap/7.50 for visual composer development server",
"product": {
"name": "vers:sap/7.50 for visual composer development server",
"product_id": "CSAFPID-2773833"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/7.50",
"product": {
"name": "vers:unknown/7.50",
"product_id": "CSAFPID-1601553"
}
}
],
"category": "product_name",
"name": "Netweaver"
}
],
"category": "product_family",
"name": "SAP"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/2025",
"product": {
"name": "vers:unknown/2025",
"product_id": "CSAFPID-2832358"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/2027",
"product": {
"name": "vers:unknown/2027",
"product_id": "CSAFPID-2832359"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/enterprise430",
"product": {
"name": "vers:unknown/enterprise430",
"product_id": "CSAFPID-2832357"
}
}
],
"category": "product_name",
"name": "SAP Business Objects Business Intelligence Platform (PMW)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/sbopdsjobserver4.3",
"product": {
"name": "vers:unknown/sbopdsjobserver4.3",
"product_id": "CSAFPID-2832331"
}
}
],
"category": "product_name",
"name": "SAP Data Services Management Console"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/unknown",
"product": {
"name": "vers:unknown/unknown",
"product_id": "CSAFPID-1333259"
}
}
],
"category": "product_name",
"name": "NetWeaver"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/ctnr-dme-podfoundation-ms1.0",
"product": {
"name": "vers:unknown/ctnr-dme-podfoundation-ms1.0",
"product_id": "CSAFPID-2832408"
}
}
],
"category": "product_name",
"name": "SAP Digital Manufacturing (Production Operator Dashboard)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/bc-fes-gui8.00",
"product": {
"name": "vers:unknown/bc-fes-gui8.00",
"product_id": "CSAFPID-1987640"
}
}
],
"category": "product_name",
"name": "SAP GUI for Windows"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/756",
"product": {
"name": "vers:unknown/756",
"product_id": "CSAFPID-2832390"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/757",
"product": {
"name": "vers:unknown/757",
"product_id": "CSAFPID-2832391"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/758",
"product": {
"name": "vers:unknown/758",
"product_id": "CSAFPID-2832392"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_gwfnd752",
"product": {
"name": "vers:unknown/sap_gwfnd752",
"product_id": "CSAFPID-2832386"
}
}
],
"category": "product_name",
"name": "SAP Gateway Client"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/106",
"product": {
"name": "vers:unknown/106",
"product_id": "CSAFPID-2832370"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/107",
"product": {
"name": "vers:unknown/107",
"product_id": "CSAFPID-2832371"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/108",
"product": {
"name": "vers:unknown/108",
"product_id": "CSAFPID-2832372"
}
}
],
"category": "product_name",
"name": "SAP Landscape Transformation (PCL Basis)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/vcframework7.50",
"product": {
"name": "vers:unknown/vcframework7.50",
"product_id": "CSAFPID-2770954"
}
}
],
"category": "product_name",
"name": "SAP NetWeaver (Visual Composer development server)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis756",
"product": {
"name": "vers:unknown/sap_basis756",
"product_id": "CSAFPID-2832405"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis757",
"product": {
"name": "vers:unknown/sap_basis757",
"product_id": "CSAFPID-2832406"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/sap_basis758",
"product": {
"name": "vers:unknown/sap_basis758",
"product_id": "CSAFPID-2832407"
}
}
],
"category": "product_name",
"name": "SAP NetWeaver Application Server ABAP and ABAP Platform"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/712",
"product": {
"name": "vers:unknown/712",
"product_id": "CSAFPID-2832354"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/713",
"product": {
"name": "vers:unknown/713",
"product_id": "CSAFPID-2832355"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/714",
"product": {
"name": "vers:unknown/714",
"product_id": "CSAFPID-2832356"
}
}
],
"category": "product_name",
"name": "SAP S/4HANA (Private Cloud \u0026 On-Premise)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/712",
"product": {
"name": "vers:unknown/712",
"product_id": "CSAFPID-2832383"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/713",
"product": {
"name": "vers:unknown/713",
"product_id": "CSAFPID-2832384"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/714",
"product": {
"name": "vers:unknown/714",
"product_id": "CSAFPID-2832385"
}
}
],
"category": "product_name",
"name": "SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL))"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/604",
"product": {
"name": "vers:unknown/604",
"product_id": "CSAFPID-2832419"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/608",
"product": {
"name": "vers:unknown/608",
"product_id": "CSAFPID-2832420"
}
}
],
"category": "product_name",
"name": "SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/104",
"product": {
"name": "vers:unknown/104",
"product_id": "CSAFPID-2832345"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/105",
"product": {
"name": "vers:unknown/105",
"product_id": "CSAFPID-2832346"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/106",
"product": {
"name": "vers:unknown/106",
"product_id": "CSAFPID-2832347"
}
}
],
"category": "product_name",
"name": "SAP S4/HANA (OData meta-data property)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/616",
"product": {
"name": "vers:unknown/616",
"product_id": "CSAFPID-2832427"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/617",
"product": {
"name": "vers:unknown/617",
"product_id": "CSAFPID-2832428"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/618",
"product": {
"name": "vers:unknown/618",
"product_id": "CSAFPID-2832411"
}
}
],
"category": "product_name",
"name": "SAP Service Parts Management (SPM)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1298148",
"product_identification_helper": {
"cpe": "cpe:/a:sap:sap:-"
}
}
}
],
"category": "product_name",
"name": "SAP Software"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/srm_server7.14",
"product": {
"name": "vers:unknown/srm_server7.14",
"product_id": "CSAFPID-2832338"
}
}
],
"category": "product_name",
"name": "SAP Supplier Relationship Management (Live Auction Cockpit)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/srm_mdm_cat7.52",
"product": {
"name": "vers:unknown/srm_mdm_cat7.52",
"product_id": "CSAFPID-1987658"
}
}
],
"category": "product_name",
"name": "SAP Supplier Relationship Management (Master Data Management Catalog)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/7.50",
"product": {
"name": "vers:unknown/7.50",
"product_id": "CSAFPID-1989115"
}
}
],
"category": "product_name",
"name": "netweaver"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/s4core_103",
"product": {
"name": "vers:unknown/s4core_103",
"product_id": "CSAFPID-1111426"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4coreop_104",
"product": {
"name": "vers:unknown/s4coreop_104",
"product_id": "CSAFPID-1111430"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/s4coreop_105",
"product": {
"name": "vers:unknown/s4coreop_105",
"product_id": "CSAFPID-1111425"
}
}
],
"category": "product_name",
"name": "pdce"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-180357",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:sap:-:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "sap"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/108",
"product": {
"name": "vers:unknown/108",
"product_id": "CSAFPID-1111423",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:s4coreop:108:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_version_range",
"name": "vers:unknown/107",
"product": {
"name": "vers:unknown/107",
"product_id": "CSAFPID-1111422",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:s4coreop:107:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_version_range",
"name": "vers:unknown/106",
"product": {
"name": "vers:unknown/106",
"product_id": "CSAFPID-1111421",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:s4coreop:106:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "s4coreop"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/s4core_102",
"product": {
"name": "vers:unknown/s4core_102",
"product_id": "CSAFPID-1111412",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_pdce:s4core_102:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "sap_pdce"
}
],
"category": "vendor",
"name": "SAP"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-42999",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-42999",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-42999.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-42999"
},
{
"cve": "CVE-2025-30018",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"notes": [
{
"category": "other",
"text": "Improper Restriction of XML External Entity Reference",
"title": "CWE-611"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30018",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30018.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-30018"
},
{
"cve": "CVE-2025-43010",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43010",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43010.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43010"
},
{
"cve": "CVE-2025-43000",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43000",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43000.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43000"
},
{
"cve": "CVE-2025-43011",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43011",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43011.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43011"
},
{
"cve": "CVE-2024-39592",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-39592",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39592.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2024-39592"
},
{
"cve": "CVE-2025-42997",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "other",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-42997",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-42997.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-42997"
},
{
"cve": "CVE-2025-43003",
"cwe": {
"id": "CWE-749",
"name": "Exposed Dangerous Method or Function"
},
"notes": [
{
"category": "other",
"text": "Exposed Dangerous Method or Function",
"title": "CWE-749"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43003",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43003.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43003"
},
{
"cve": "CVE-2025-43009",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43009",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43009.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43009"
},
{
"cve": "CVE-2025-43007",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43007",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43007.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43007"
},
{
"cve": "CVE-2025-31329",
"cwe": {
"id": "CWE-141",
"name": "Improper Neutralization of Parameter/Argument Delimiters"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Parameter/Argument Delimiters",
"title": "CWE-141"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31329",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31329.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-31329"
},
{
"cve": "CVE-2025-43006",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43006",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43006.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43006"
},
{
"cve": "CVE-2025-43008",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43008",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43008.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43008"
},
{
"cve": "CVE-2025-43004",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43004",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43004.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43004"
},
{
"cve": "CVE-2025-26662",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-26662",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-26662.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-26662"
},
{
"cve": "CVE-2025-43002",
"cwe": {
"id": "CWE-472",
"name": "External Control of Assumed-Immutable Web Parameter"
},
"notes": [
{
"category": "other",
"text": "External Control of Assumed-Immutable Web Parameter",
"title": "CWE-472"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43002",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43002.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43002"
},
{
"cve": "CVE-2025-43005",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"notes": [
{
"category": "other",
"text": "Plaintext Storage of a Password",
"title": "CWE-256"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43005",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-43005.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-43005"
},
{
"cve": "CVE-2025-31324",
"cwe": {
"id": "CWE-434",
"name": "Unrestricted Upload of File with Dangerous Type"
},
"notes": [
{
"category": "other",
"text": "Unrestricted Upload of File with Dangerous Type",
"title": "CWE-434"
},
{
"category": "other",
"text": "Improper Authorization",
"title": "CWE-285"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31324",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31324.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2773833",
"CSAFPID-1601553",
"CSAFPID-2832358",
"CSAFPID-2832359",
"CSAFPID-2832357",
"CSAFPID-2832331",
"CSAFPID-1333259",
"CSAFPID-2832408",
"CSAFPID-1987640",
"CSAFPID-2832390",
"CSAFPID-2832391",
"CSAFPID-2832392",
"CSAFPID-2832386",
"CSAFPID-2832370",
"CSAFPID-2832371",
"CSAFPID-2832372",
"CSAFPID-2770954",
"CSAFPID-2832405",
"CSAFPID-2832406",
"CSAFPID-2832407",
"CSAFPID-2832354",
"CSAFPID-2832355",
"CSAFPID-2832356",
"CSAFPID-2832383",
"CSAFPID-2832384",
"CSAFPID-2832385",
"CSAFPID-2832419",
"CSAFPID-2832420",
"CSAFPID-2832345",
"CSAFPID-2832346",
"CSAFPID-2832347",
"CSAFPID-2832427",
"CSAFPID-2832428",
"CSAFPID-2832411",
"CSAFPID-1298148",
"CSAFPID-2832338",
"CSAFPID-1987658",
"CSAFPID-1989115",
"CSAFPID-1111426",
"CSAFPID-1111430",
"CSAFPID-1111425",
"CSAFPID-180357",
"CSAFPID-1111423",
"CSAFPID-1111422",
"CSAFPID-1111421",
"CSAFPID-1111412"
]
}
],
"title": "CVE-2025-31324"
}
]
}
CERTFR-2025-AVI-0396
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | S/4HANA | S/4HANA HCM Portugal and SAP ERP HCM Portugal versions S4HCMCPT 100, 101, SAP_HRCPT 600, 604 et 608 | ||
| SAP | N/A | Service Parts Management (SPM) versions SAP_APPL 600, 602, 603, 604, 605, 606, 616, 617, 618, SAPSCORE 111, S4CORE 100, 101 et 102 | ||
| SAP | NetWeaver | NetWeaver (Visual Composer development server) version VCFRAMEWORK 7.50 | ||
| SAP | N/A | Supplier Relationship Management (Master Data Management Catalog) version SRM_MDM_CAT 7.52 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 2025 | ||
| SAP | N/A | Business Objects Business Intelligence Platform (PMW) versions ENTERPRISE 430, 2025 et 2027 | ||
| SAP | NetWeaver Application Server ABAP et ABAP Platform | NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 | ||
| SAP | N/A | Data Services Management Console version SBOP DS JOB SERVER 4.3 | ||
| SAP | N/A | Digital Manufacturing (Production Operator Dashboard) version CTNR-DME-PODFOUNDATION-MS 1.0 | ||
| SAP | N/A | Fiori for SAP ERP versions SAP_GWFND 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 | ||
| SAP | S/4HANA | S4/HANA (OData meta-data property) versions S4CORE 102, 103, 104, 105 et 106 | ||
| SAP | S/4HANA | S/4HANA (Private Cloud & On-Premise) versions S4CRM 204, 205, 206, S4CEXT 107, 108, BBPCRM 702, 712, 713, 714 | ||
| SAP | S/4HANA | S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) versions S4CORE 102, 103, 104, 105, 106, 107, 108, SCM_BASIS 700, 701, 702, 712, 713 et 714 | ||
| SAP | N/A | Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758 | ||
| SAP | N/A | Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14 | ||
| SAP | N/A | Service Parts Management (SPM) versions SAP_APPL 617, 618, SAPSCORE 116, S4CORE 100, 101, 102 et 103 | ||
| SAP | N/A | PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108 | ||
| SAP | N/A | Landscape Transformation (PCL Basis) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752, 2020, S4CORE 102, 103, 104, 105, 106, 107 et 108 | ||
| SAP | N/A | GUI for Windows version BC-FES-GUI 8.00 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "S/4HANA HCM Portugal and SAP ERP HCM Portugal versions S4HCMCPT 100, 101, SAP_HRCPT 600, 604 et 608",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Service Parts Management (SPM) versions SAP_APPL 600, 602, 603, 604, 605, 606, 616, 617, 618, SAPSCORE 111, S4CORE 100, 101 et 102",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (Visual Composer development server) version VCFRAMEWORK 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (Master Data Management Catalog) version SRM_MDM_CAT 7.52",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 2025",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform (PMW) versions ENTERPRISE 430, 2025 et 2027",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
"product": {
"name": "NetWeaver Application Server ABAP et ABAP Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Data Services Management Console version SBOP DS JOB SERVER 4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Digital Manufacturing (Production Operator Dashboard) version CTNR-DME-PODFOUNDATION-MS 1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Fiori for SAP ERP versions SAP_GWFND 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S4/HANA (OData meta-data property) versions S4CORE 102, 103, 104, 105 et 106",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Private Cloud \u0026 On-Premise) versions S4CRM 204, 205, 206, S4CEXT 107, 108, BBPCRM 702, 712, 713, 714",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) versions S4CORE 102, 103, 104, 105, 106, 107, 108, SCM_BASIS 700, 701, 702, 712, 713 et 714",
"product": {
"name": "S/4HANA",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Service Parts Management (SPM) versions SAP_APPL 617, 618, SAPSCORE 116, S4CORE 100, 101, 102 et 103",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "PDCE versions S4CORE 102, 103, S4COREOP 104, 105, 106, 107 et 108",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Landscape Transformation (PCL Basis) versions DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752, 2020, S4CORE 102, 103, 104, 105, 106, 107 et 108",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "GUI for Windows version BC-FES-GUI 8.00",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-43003",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43003"
},
{
"name": "CVE-2025-43007",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43007"
},
{
"name": "CVE-2025-23191",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23191"
},
{
"name": "CVE-2025-42999",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42999"
},
{
"name": "CVE-2025-43009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43009"
},
{
"name": "CVE-2025-43011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43011"
},
{
"name": "CVE-2025-43006",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43006"
},
{
"name": "CVE-2025-0060",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0060"
},
{
"name": "CVE-2025-30012",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30012"
},
{
"name": "CVE-2025-43000",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43000"
},
{
"name": "CVE-2025-43004",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43004"
},
{
"name": "CVE-2025-31324",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31324"
},
{
"name": "CVE-2025-43005",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43005"
},
{
"name": "CVE-2025-43008",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43008"
},
{
"name": "CVE-2025-31329",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31329"
},
{
"name": "CVE-2025-30009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30009"
},
{
"name": "CVE-2025-30011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30011"
},
{
"name": "CVE-2025-43002",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43002"
},
{
"name": "CVE-2025-26662",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26662"
},
{
"name": "CVE-2025-30010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30010"
},
{
"name": "CVE-2025-42997",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42997"
},
{
"name": "CVE-2025-0061",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0061"
},
{
"name": "CVE-2025-43010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43010"
},
{
"name": "CVE-2024-39592",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39592"
},
{
"name": "CVE-2025-30018",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30018"
}
],
"initial_release_date": "2025-05-13T00:00:00",
"last_revision_date": "2025-06-12T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0396",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-05-13T00:00:00.000000"
},
{
"description": "Ajout des identifiants CVE CVE-2025-0060, CVE-2025-0061 et CVE-2025-23191",
"revision_date": "2025-06-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-05-13",
"title": "Bulletin de s\u00e9curit\u00e9 SAP may-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2025.html"
}
]
}
CERTFR-2025-AVI-0564
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | NetWeaver | NetWeaver et ABAP Platform (SDCCN) versions ST-PI 2008_1_700, 2008_1_710 et 740 | ||
| SAP | NetWeaver | NetWeaver Application Server ABAP and ABAP Platform versionsAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430, 2025, 2027, ENTERPRISECLIENTTOOLS 430, 2025 et 2027 | ||
| SAP | NetWeaver | NetWeaver Application Server Java version ENGINEAPI 7.50 | ||
| SAP | NetWeaver | NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 | ||
| SAP | Business Warehouse | Business Warehouse and SAP BW/4HANA BEx Tools version DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701 | ||
| SAP | NetWeaver | NetWeaver Enterprise Portal Administration version EP-RUNTIME 7.50 | ||
| SAP | Business Objects Business Intelligence Platform | Business Objects Business Intelligence Platform (CMC) versions ENTERPRISE 430 et 2025 | ||
| SAP | NetWeaver | NetWeaver Enterprise Portal Federated Portal Network version EP-RUNTIME 7.50 | ||
| SAP | NetWeaver | NetWeaver (RFC enabled function module) versions SAP_BW 700, 701, 702, 710, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 914 et 916 | ||
| SAP | NetWeaver | NetWeaver Application Server ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 | ||
| SAP | S/4HANA (Private Cloud) | S/4HANA and SAP SCM (Characteristic Propagation) versions SCMAPO 713, 714, S4CORE 102, 103, 104, S4COREOP 105, 106, 107, 108, SCM 700, 701, 702 et 712 | ||
| SAP | N/A | SAPCAR versions SAP_CAR 7.53 et 7.22EXT | ||
| SAP | S/4HANA (Private Cloud) | S/4HANA (Enterprise Event Enablement) versions SAP_GWFND 757 et 758 | ||
| SAP | NetWeaver | NetWeaver ABAP Server and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 914 et SAP_BASIS 915 | ||
| SAP | NetWeaver | NetWeaver et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753 et SAP_BASIS 754 | ||
| SAP | NetWeaver | NetWeaver Application Server for Java (Log Viewer) version LMNWABASICAPPS 7.50 | ||
| SAP | NetWeaver | NetWeaver (XML Data Archiving Service) version J2EE-APPS 7.50 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects Content Administrator workbench versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701 | ||
| SAP | N/A | Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758 | ||
| SAP | N/A | Data Services (DQ Report) versions SBOP_DS_MANAGEMENT_CONSOLE 4.3 et 2025 | ||
| SAP | NetWeaver | NetWeaver Visual Composer version VCBASE 7.50 | ||
| SAP | NetWeaver | NetWeaver Business Warehouse (CCAW application) versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701 | ||
| SAP | N/A | Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14 | ||
| SAP | Business Warehouse | Business Warehouse (Business Explorer Web 3.5 loading animation) versions DW4CORE 100, 200, 300, 400, 916, SAP_BW 730, 731, 740, 750, 751, 752, 753, 754, 756, 757 et 758 | ||
| SAP | NetWeaver | NetWeaver Application Server for ABAP versions SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 | ||
| SAP | Business Objects Business Intelligence Platform | BusinessObjects BI Platform Central Management Console Promotion Management Application versions ENTERPRISE 430, 2025 et 2027 | ||
| SAP | Business Warehouse | Business Warehouse et SAP Plug-In Basis versions PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver et ABAP Platform (SDCCN) versions ST-PI 2008_1_700, 2008_1_710 et 740",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP and ABAP Platform versionsAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform (Web Intelligence) versions ENTERPRISE 430, 2025, 2027, ENTERPRISECLIENTTOOLS 430, 2025 et 2027",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server Java version ENGINEAPI 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse and SAP BW/4HANA BEx Tools version DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701",
"product": {
"name": "Business Warehouse",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal Administration version EP-RUNTIME 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Objects Business Intelligence Platform (CMC) versions ENTERPRISE 430 et 2025",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Enterprise Portal Federated Portal Network version EP-RUNTIME 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (RFC enabled function module) versions SAP_BW 700, 701, 702, 710, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 914 et 916",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA and SAP SCM (Characteristic Propagation) versions SCMAPO 713, 714, S4CORE 102, 103, 104, S4COREOP 105, 106, 107, 108, SCM 700, 701, 702 et 712",
"product": {
"name": "S/4HANA (Private Cloud)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "SAPCAR versions SAP_CAR 7.53 et 7.22EXT",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "S/4HANA (Enterprise Event Enablement) versions SAP_GWFND 757 et 758",
"product": {
"name": "S/4HANA (Private Cloud)",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver ABAP Server and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 914 et SAP_BASIS 915",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver et ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753 et SAP_BASIS 754",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for Java (Log Viewer) version LMNWABASICAPPS 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver (XML Data Archiving Service) version J2EE-APPS 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Content Administrator workbench versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Gateway Client versions SAP_GWFND 752, 753, 754, 755, 756, 757 et 758",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Data Services (DQ Report) versions SBOP_DS_MANAGEMENT_CONSOLE 4.3 et 2025",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Visual Composer version VCBASE 7.50",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Business Warehouse (CCAW application) versions DW4CORE 100, 200, 300, 400, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 et SAP_BW_VIRTUAL_COMP 701",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Supplier Relationship Management (Live Auction Cockpit) version SRM_SERVER 7.14",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse (Business Explorer Web 3.5 loading animation) versions DW4CORE 100, 200, 300, 400, 916, SAP_BW 730, 731, 740, 750, 751, 752, 753, 754, 756, 757 et 758",
"product": {
"name": "Business Warehouse",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP versions SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816",
"product": {
"name": "NetWeaver",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects BI Platform Central Management Console Promotion Management Application versions ENTERPRISE 430, 2025 et 2027",
"product": {
"name": "Business Objects Business Intelligence Platform",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse et SAP Plug-In Basis versions PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et 816",
"product": {
"name": "Business Warehouse",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-42985",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42985"
},
{
"name": "CVE-2025-42968",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42968"
},
{
"name": "CVE-2025-42971",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42971"
},
{
"name": "CVE-2025-42954",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42954"
},
{
"name": "CVE-2025-42970",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42970"
},
{
"name": "CVE-2025-42953",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42953"
},
{
"name": "CVE-2025-31326",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31326"
},
{
"name": "CVE-2025-42961",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42961"
},
{
"name": "CVE-2025-42974",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42974"
},
{
"name": "CVE-2025-42978",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42978"
},
{
"name": "CVE-2025-30012",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30012"
},
{
"name": "CVE-2025-42952",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42952"
},
{
"name": "CVE-2025-42981",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42981"
},
{
"name": "CVE-2025-42979",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42979"
},
{
"name": "CVE-2025-42993",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42993"
},
{
"name": "CVE-2025-42959",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42959"
},
{
"name": "CVE-2025-42963",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42963"
},
{
"name": "CVE-2025-42969",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42969"
},
{
"name": "CVE-2025-42977",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42977"
},
{
"name": "CVE-2025-42986",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42986"
},
{
"name": "CVE-2025-42966",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42966"
},
{
"name": "CVE-2025-30009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30009"
},
{
"name": "CVE-2025-30011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30011"
},
{
"name": "CVE-2025-42962",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42962"
},
{
"name": "CVE-2025-42956",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42956"
},
{
"name": "CVE-2025-43001",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43001"
},
{
"name": "CVE-2024-53677",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53677"
},
{
"name": "CVE-2025-30010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30010"
},
{
"name": "CVE-2025-42997",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42997"
},
{
"name": "CVE-2025-42965",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42965"
},
{
"name": "CVE-2025-30018",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30018"
},
{
"name": "CVE-2025-42967",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42967"
},
{
"name": "CVE-2025-42980",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42980"
},
{
"name": "CVE-2025-42964",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42964"
},
{
"name": "CVE-2025-42992",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42992"
},
{
"name": "CVE-2025-42973",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42973"
},
{
"name": "CVE-2025-42960",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-42960"
}
],
"initial_release_date": "2025-07-08T00:00:00",
"last_revision_date": "2025-07-08T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0564",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-07-08T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2025-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 SAP july-2025",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html"
}
]
}
cnvd-2025-11412
Vulnerability from cnvd
Title
SAP Gateway Client信息泄露漏洞
Description
SAP Gateway Client是德国思爱普（SAP）公司的一个OData服务测试与调试工具，集成于SAP NetWeaver网关。
SAP Gateway Client存在信息泄露漏洞，该漏洞源于权限管理不当，攻击者可利用该漏洞导致信息泄露。
Severity
中
VLAI Severity ?
Patch Name
SAP Gateway Client信息泄露漏洞的补丁
Patch Description
SAP Gateway Client是德国思爱普（SAP）公司的一个OData服务测试与调试工具，集成于SAP NetWeaver网关。
SAP Gateway Client存在信息泄露漏洞，该漏洞源于权限管理不当，攻击者可利用该漏洞导致信息泄露。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
目前厂商已发布升级程序修复该安全问题，详情见厂商官网： https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2025.html
Reference
https://me.sap.com/notes/3577300
Impacted products
| Name | SAP Gateway Client |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2025-42997",
"cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-42997"
}
},
"description": "SAP Gateway Client\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u4e2aOData\u670d\u52a1\u6d4b\u8bd5\u4e0e\u8c03\u8bd5\u5de5\u5177\uff0c\u96c6\u6210\u4e8eSAP NetWeaver\u7f51\u5173\u3002\n\nSAP Gateway Client\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u6743\u9650\u7ba1\u7406\u4e0d\u5f53\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u4fe1\u606f\u6cc4\u9732\u3002",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2025.html",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2025-11412",
"openTime": "2025-06-03",
"patchDescription": "SAP Gateway Client\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u4e2aOData\u670d\u52a1\u6d4b\u8bd5\u4e0e\u8c03\u8bd5\u5de5\u5177\uff0c\u96c6\u6210\u4e8eSAP NetWeaver\u7f51\u5173\u3002\r\n\r\nSAP Gateway Client\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u6743\u9650\u7ba1\u7406\u4e0d\u5f53\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u4fe1\u606f\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "SAP Gateway Client\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "SAP Gateway Client"
},
"referenceLink": "https://me.sap.com/notes/3577300",
"serverity": "\u4e2d",
"submitTime": "2025-05-28",
"title": "SAP Gateway Client\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}
fkie_cve-2025-42997
Vulnerability from fkie_nvd
Published
2025-05-13 01:15
Modified
2025-05-13 19:35
Severity ?
Summary
Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability."
},
{
"lang": "es",
"value": "En determinadas circunstancias, SAP Gateway Client permite a un usuario con privilegios elevados acceder a informaci\u00f3n restringida fuera del alcance de la aplicaci\u00f3n. Debido a la posibilidad de influir en el comportamiento o el rendimiento de la aplicaci\u00f3n mediante el uso indebido de los datos expuestos, esto podr\u00eda tener un impacto m\u00ednimo en la confidencialidad, la integridad y la disponibilidad."
}
],
"id": "CVE-2025-42997",
"lastModified": "2025-05-13T19:35:25.503",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7,
"source": "cna@sap.com",
"type": "Primary"
}
]
},
"published": "2025-05-13T01:15:48.293",
"references": [
{
"source": "cna@sap.com",
"url": "https://me.sap.com/notes/3577300"
},
{
"source": "cna@sap.com",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"sourceIdentifier": "cna@sap.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-732"
}
],
"source": "cna@sap.com",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…