
CVE-2025-42978 – Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java
https://notcve.org/view.php?id=CVE-2025-42978
08 Jul 2025 — The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection against the wildcard hostname defined in the received certificate of remote TLS server. This might lead to the outbound connection being established to a possibly malicious remote TLS server and hence disclose information. Integrity and Availability are not impacted. • https://me.sap.com/notes/3557179 • CWE-940: Improper Verification of Source of a Communication Channel •

CVE-2025-42963 – Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer )
https://notcve.org/view.php?id=CVE-2025-42963
08 Jul 2025 — A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation can lead to full operating system compromise, granting attackers complete control over the affected system. This results in a severe impact on the confidentiality, integrity, and availability of the application and host environment. • https://me.sap.com/notes/3621771 • CWE-502: Deserialization of Untrusted Data •

CVE-2023-42480 – Information Disclosure in NetWeaver AS Java Logon
https://notcve.org/view.php?id=CVE-2023-42480
14 Nov 2023 — The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability. El atacante no autenticado en la aplicación NetWeaver AS Java Logon versión 7.50 puede forzar la funcionalidad de inicio de sesión para identificar los ID de usuario legítimos. Esto tendrá un impacto en la confidencialidad, pero no hay ningún otro ... • https://me.sap.com/notes/3366410 • CWE-307: Improper Restriction of Excessive Authentication Attempts •

CVE-2023-42477 – Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application)
https://notcve.org/view.php?id=CVE-2023-42477
10 Oct 2023 — SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application. SAP NetWeaver AS Java (aplicación GRMG Heartbeat): versión 7.50, permite a un atacante enviar una solicitud manipulada desde una aplicación web vulnerable, lo que provoca un impacto limitado en la confidencialidad y la integridad de la aplicación. SAP NetWeaver AS Java (GRMG Heartbeat app... • https://me.sap.com/notes/3333426 • CWE-918: Server-Side Request Forgery (SSRF) •

CVE-2023-31405 – Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)
https://notcve.org/view.php?id=CVE-2023-31405
11 Jul 2023 — SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability. • https://me.sap.com/notes/3324732 • CWE-117: Improper Output Neutralization for Logs •

CVE-2023-30744 – Improper access control during application start-up in SAP AS NetWeaver JAVA.
https://notcve.org/view.php?id=CVE-2023-30744
09 May 2023 — In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use of an open naming and directory API to instantiate an object which has methods which can be called without further authorization and authentication. A subsequent call to one of these methods can read or change the state of existing services without any effect on availability. • https://launchpad.support.sap.com/#/notes/3317453 • CWE-306: Missing Authentication for Critical Function •

CVE-2023-27268 – Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service)
https://notcve.org/view.php?id=CVE-2023-27268
14 Mar 2023 — SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability., resulting in escalation of privileges. • https://launchpad.support.sap.com/#/notes/3288480 • CWE-284: Improper Access Control •

CVE-2023-26460 – Improper Access Control in SAP NetWeaver AS Java (Cache Management Service)
https://notcve.org/view.php?id=CVE-2023-26460
14 Mar 2023 — Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that require user identity • https://launchpad.support.sap.com/#/notes/3288096 • CWE-284: Improper Access Control •

CVE-2023-24526 – Improper Access Control in SAP NetWeaver AS Java (Classload Service)
https://notcve.org/view.php?id=CVE-2023-24526
14 Mar 2023 — SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user identity, resulting in escalation of privileges. This failure has a low impact on confidentiality of the data such that an unassigned user can read non-sensitive server data. • https://launchpad.support.sap.com/#/notes/3288394 • CWE-306: Missing Authentication for Critical Function •

CVE-2023-23857 – Improper Access Control in SAP NetWeaver AS for Java
https://notcve.org/view.php?id=CVE-2023-23857
14 Mar 2023 — Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and services across systems. On a successful exploitation, the attacker can read and modify some sensitive information but can also be used to lock up any element or operation of the system making that it unresponsive or unavailab... • https://launchpad.support.sap.com/#/notes/3252433 • CWE-287: Improper Authentication •