Sap Supplier Relationship Management (Live Auction Cockpit)
Approved changes feed: RSS · Atom
cpe:2.3:a:sap_se:sap_supplier_relationship_management_(live_auction_cockpit):*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Sap Se (f8f3f5db-c060-5230-a8bd-f91674203607) |
|---|---|
| Product | Sap Supplier Relationship Management (Live Auction Cockpit) (700e0f33-49ae-542f-80b9-20589235bc60) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-30018 |
vulnerable | 2026-06-08 07:16:58.838885 |
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
HIGH (8.6)
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerability has a high impact on the application's confidentiality, with no effect on integrity and availability of the application.
Published: 2025-05-13T00:16:20.584Z
Updated: 2025-05-13T14:12:04.345Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-30012 |
vulnerable | 2026-06-08 07:16:58.823259 |
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
CRITICAL (10)
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to send malicious payload request in a specific encoding format. The servlet will then decode this malicious request which will result in deserialization of data in the application leading to execution of arbitrary OS command on target as SAP Administrator. This vulnerability has High impact on confidentiality, integrity, and availability of the application.
Published: 2025-05-13T00:14:21.258Z
Updated: 2025-07-24T15:59:18.619Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-30011 |
vulnerable | 2026-06-08 07:16:58.822852 |
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
MEDIUM (5.3)
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to send an malicious request to the application, which could disclose the internal version details of the affected system. This vulnerability has low impact on confidentiality, with no effect on integrity and availability of the application.
Published: 2025-05-13T00:13:16.048Z
Updated: 2025-05-13T18:39:20.127Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-30010 |
vulnerable | 2026-06-08 07:16:58.822418 |
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
MEDIUM (6.1)
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to craft a malicious link, which when clicked by a victim, redirects the browser to a malicious site. On successful exploitation, the attacker could cause low impact on confidentiality and integrity with no impact on the availability of the application.
Published: 2025-05-13T00:13:04.776Z
Updated: 2025-05-13T14:27:01.826Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-30009 |
vulnerable | 2026-06-08 07:16:58.820542 |
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
MEDIUM (6.1)
he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to execute malicious script in the victim�s browser. This vulnerability has low impact on confidentiality and integrity within the scope of that victim�s browser, with no effect on availability of the application
Published: 2025-05-13T00:12:52.634Z
Updated: 2025-05-13T14:06:31.756Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.