NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in SAP producten
view advisory published 2025-09-09
SAP heeft kwetsbaarheden verholpen in verschillende producten, waaronder in SAP NetWeaver, SAP NetWeaver Application Server Java en SAP Landscape Transformation.
01
describes (27)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-42958US | — | — | ||
Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensiti… | ||||
| CVE-2025-42944US | — | Exploit | ||
Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open p… | ||||
| CVE-2025-42938US | — | — | ||
Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. I… | ||||
| CVE-2025-42933US | — | — | ||
When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leads to exposure of sensitive credentials… | ||||
| CVE-2025-42930US | — | — | ||
SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive reso… | ||||
| CVE-2025-42929US | — | — | ||
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an… | ||||
| CVE-2025-42927US | — | — | ||
SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenS… | ||||
| CVE-2025-42926US | medium5.3OT elevated | — | ||
SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully explo… | ||||
| CVE-2025-42925US | — | — | ||
Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers… | ||||
| CVE-2025-42923US | — | — | ||
Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to send unintended request to the web server.… | ||||
| CVE-2025-42922US | — | — | ||
SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can l… | ||||
| CVE-2025-42920US | — | — | ||
Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly acce… | ||||
| CVE-2025-42918US | —OT elevated | — | ||
SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameters. This results in a… | ||||
| CVE-2025-42917US | —OT elevated | — | ||
SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a… | ||||
| CVE-2025-42916US | — | — | ||
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an… | ||||
| CVE-2025-42915US | —OT elevated | — | ||
Fiori app Manage Payment Blocks does not perform the necessary authorization checks, allowing an attacker with basic user privileges to abuse functionalities that should be restric… | ||||
| CVE-2025-42914US | —OT elevated | — | ||
Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform a… | ||||
| CVE-2025-42913US | —OT elevated | — | ||
Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform a… | ||||
| CVE-2025-42912US | —OT elevated | — | ||
SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a signif… | ||||
| CVE-2025-42911US | medium4.3OT elevated | — | ||
SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operat… | ||||
showing 20 of 27
02
references
External citations — patches, advisories, analysis.
- Referenceexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan