Skip to content
OpenAdvisories

Archive

13 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /13 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

136 results · Clear filters · Feed

  • Medium 6.4
    CVE-2025-43003

    Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)

    SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field. On performing this step the attacker could gain access to highly sensitive information. …

    SAP SAP S/4HANA (Private Cloud & On-Premise)
  • Medium 4.3
    CVE-2025-43002

    Missing Authorization check in SAP S4/HANA (OData meta-data property)

    SAP S4CORE OData meta-data property allows an authenticated attacker to access restricted information due to missing authorization check. This could cause a low impact on confidentiality but integrity and availability of the application are not impacted.

    SAP SAP S4/HANA (OData meta-data property)
  • Medium 6.6
    CVE-2025-42997

    Information Disclosure vulnerability in SAP Gateway Client

    Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this…

    SAP SAP Gateway Client
  • Medium 6.2
    CVE-2025-31329

    Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

    SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. An attacker with administrative privileges can craft these instructions so that when accessed by the vic…

    SAP SAP NetWeaver Application Server ABAP and ABAP Platform
  • Medium 5.3
    CVE-2025-30011

    Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

    The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to send an malicious request to the application, which could disclose the …

    SAP SAP Supplier Relationship Management (Live Auction Cockpit)
  • Medium 6.1
    CVE-2025-30010

    Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

    The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to craft a malicious link, which when clicked by a victim, redirects the b…

    SAP SAP Supplier Relationship Management (Live Auction Cockpit)
  • Medium 6.1
    CVE-2025-30009

    Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

    he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to execute malicious script in the victim�s browser. This vulnerability has…

    SAP SAP Supplier Relationship Management (Live Auction Cockpit)
  • Medium 4.4
    CVE-2025-26662

    Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console

    The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed with…

    SAP SAP Data Services Management Console
  • Medium 5.4
    CVE-2025-45864

    TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolStart parameter in th…

  • Medium 5.4
    CVE-2025-45866

    TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolEnd parameter in the …

  • Medium 6.5
    CVE-2025-45746

    In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authentic…

    ZKTeco ZKBio CVSecurity
  • Medium 5.4
    CVE-2025-45867

    TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the static_dns1 parameter in the …

  • Medium 5.4
    CVE-2025-45859

    TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the bandstr parameter in the form…

  • Medium 5.1
    CVE-2025-44039 Public exploit

    CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console.…

  • Medium 6.1
    CVE-2025-47204 Scanner template

    Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data

    An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cros…

    bootstrap-multiselect npm
  • Medium 5.4
    CVE-2025-47905

    Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via …

    varnish-software Varnish Cache varnish varnish Debian Ubuntu Alpine