DeutschShown in its original language — a full translation is planned for a future version.
SAP Software: Mehrere Schwachstellen
view advisory published 2025-06-09
Ein entfernter Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erhöhe, um Informationen offenzulegen, um Sicherheitsmechanismen zu umgehen und um Cross-Site Scripting Angriffe durchzuführen.
01
describes (16)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-42998US | — | — | ||
The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. Th… | ||||
| CVE-2025-42996US | — | — | ||
SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticate giving the ability to access or modify… | ||||
| CVE-2025-42995US | — | — | ||
SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and… | ||||
| CVE-2025-42994US | — | — | ||
SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fai… | ||||
| CVE-2025-42993US | —OT elevated | — | ||
Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound Binding Configuration could create an RFC de… | ||||
| CVE-2025-42991US | —OT elevated | — | ||
SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows an authenticated 'approver' user to delete attachment from bank account applicat… | ||||
| CVE-2025-42990US | — | — | ||
Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled… | ||||
| CVE-2025-42989US | —OT elevated | — | ||
RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker cou… | ||||
| CVE-2025-42988US | medium5.3 | — | ||
Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially cr… | ||||
| CVE-2025-42987US | —OT elevated | — | ||
SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter. Due to missing author… | ||||
| CVE-2025-42984US | —OT elevated | — | ||
SAP S/4HANA Manage Central Purchase Contract does not perform necessary authorization checks for an authenticated user. Due to this, an attacker could execute the function import o… | ||||
| CVE-2025-42983US | —OT elevated | — | ||
SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to drop arbitrary SAP database tables, potentially resulting in a loss of data or rendering the system… | ||||
| CVE-2025-42982US | —OT elevated | — | ||
SAP GRC allows a non-administrative user to access and initiate transaction which could allow them to modify or control the transmitted system credentials. This causes high impact… | ||||
| CVE-2025-42977US | — | — | ||
SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user. This allows an attac… | ||||
| CVE-2025-31325US | — | — | ||
Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject malicious JavaScript into a web page through an… | ||||
| CVE-2025-23192US | high7.6 | — | ||
SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the wor… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan