NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in SAP Producten
view advisory published 2025-10-17
SAP heeft kwetsbaarheden verholpen in diverse SAP producten.
01
describes (15)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-42939US | —OT elevated | — | ||
SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tamperin… | ||||
| CVE-2025-42937US | — | — | ||
SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directory and over-wr… | ||||
| CVE-2025-42910US | — | — | ||
Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include exec… | ||||
| CVE-2025-42909US | — | — | ||
SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in an existing SAP CAL appliances to gain acc… | ||||
| CVE-2025-42908US | — | — | ||
Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the sessio… | ||||
| CVE-2025-42906US | — | — | ||
SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administratio… | ||||
| CVE-2025-42903US | — | — | ||
A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of personal data through resp… | ||||
| CVE-2025-42902US | — | — | ||
Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket to… | ||||
| CVE-2025-42901US | — | — | ||
SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affected… | ||||
| CVE-2025-42944US | — | Exploit | ||
Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open p… | ||||
| CVE-2025-5115US | high7.5 | — | ||
In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending fra… | ||||
| CVE-2025-48913US | — | — | ||
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is n… | ||||
| CVE-2025-31672US | — | — | ||
Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and… | ||||
| CVE-2025-31331US | —OT elevated | — | ||
SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation. Once logged into the… | ||||
| CVE-2025-0059US | — | — | ||
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative… | ||||
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan