DeutschShown in its original language — a full translation is planned for a future version.
SAP Patchday September 2025: Mehrere Schwachstellen
view advisory published 2025-09-08
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere nicht näher spezifizierte Auswirkungen zu verursachen.
01
describes (28)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-42907US | — | — | ||
SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping r… | ||||
| CVE-2025-42958US | — | — | ||
Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensiti… | ||||
| CVE-2025-42944US | — | Exploit | ||
Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open p… | ||||
| CVE-2025-42938US | — | — | ||
Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. I… | ||||
| CVE-2025-42933US | — | — | ||
When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leads to exposure of sensitive credentials… | ||||
| CVE-2025-42930US | — | — | ||
SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive reso… | ||||
| CVE-2025-42929US | — | — | ||
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an… | ||||
| CVE-2025-42927US | — | — | ||
SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenS… | ||||
| CVE-2025-42926US | medium5.3OT elevated | — | ||
SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully explo… | ||||
| CVE-2025-42925US | — | — | ||
Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers… | ||||
| CVE-2025-42923US | — | — | ||
Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to send unintended request to the web server.… | ||||
| CVE-2025-42922US | — | — | ||
SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can l… | ||||
| CVE-2025-42920US | — | — | ||
Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly acce… | ||||
| CVE-2025-42918US | —OT elevated | — | ||
SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameters. This results in a… | ||||
| CVE-2025-42917US | —OT elevated | — | ||
SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a… | ||||
| CVE-2025-42916US | — | — | ||
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an… | ||||
| CVE-2025-42915US | —OT elevated | — | ||
Fiori app Manage Payment Blocks does not perform the necessary authorization checks, allowing an attacker with basic user privileges to abuse functionalities that should be restric… | ||||
| CVE-2025-42914US | —OT elevated | — | ||
Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform a… | ||||
| CVE-2025-42913US | —OT elevated | — | ||
Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform a… | ||||
| CVE-2025-42912US | —OT elevated | — | ||
SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a signif… | ||||
showing 20 of 28
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan