DeutschShown in its original language — a full translation is planned for a future version.
SAP Patchday Juli 2025: Mehrere Schwachstellen
view advisory published 2025-07-07
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um erhöhte Berechtigungen zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder andere nicht spezifizierte Auswirkungen zu verursachen.
01
describes (36)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-42956US | — | — | ||
SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make publicly available. When an authenticated… | ||||
| CVE-2025-43001US | — | — | ||
SAPCAR allows an attacker logged in with high privileges to override the permissions of the current and parent directories of the user or process extracting the archive, leading to… | ||||
| CVE-2025-42992US | — | — | ||
SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to exploit critical files and directory permiss… | ||||
| CVE-2025-42986US | —OT elevated | — | ||
Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), pote… | ||||
| CVE-2025-42985US | — | — | ||
Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a victim�s browser. This co… | ||||
| CVE-2025-42981US | — | — | ||
Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script at a location not pr… | ||||
| CVE-2025-42980US | — | — | ||
SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially… | ||||
| CVE-2025-42979US | — | — | ||
The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on t… | ||||
| CVE-2025-42978US | — | — | ||
The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection ag… | ||||
| CVE-2025-42974US | —OT elevated | — | ||
Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable access to information norm… | ||||
| CVE-2025-42973US | — | — | ||
Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associated with DQ job status… | ||||
| CVE-2025-42971US | — | — | ||
A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim extracts this malicious archive, it gets p… | ||||
| CVE-2025-42970US | — | — | ||
SAPCAR improperly sanitizes the file paths while extracting SAPCAR archives. Due to this, an attacker could craft a malicious SAPCAR archive containing directory traversal sequence… | ||||
| CVE-2025-42969US | — | — | ||
SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The victim, when tricked int… | ||||
| CVE-2025-42968US | medium4.3OT elevated | — | ||
SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system… | ||||
| CVE-2025-42967US | — | — | ||
SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privileges to create a new report with his own c… | ||||
| CVE-2025-42966US | — | — | ||
SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a spec… | ||||
| CVE-2025-42965US | — | — | ||
SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing res… | ||||
| CVE-2025-42964US | — | — | ||
SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a… | ||||
| CVE-2025-42963US | — | — | ||
A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful… | ||||
showing 20 of 36
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan