NLIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Kwetsbaarheden verholpen in SAP producten
Advisory ansehen veröffentlicht 2025-01-14
SAP heeft kwetsbaarheden verholpen in SAP, NetWeaver en ABAP.
01
beschreibt (13)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-0070US | — | — | ||
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication check… | ||||
| CVE-2025-0069US | — | — | ||
Due to DLL injection vulnerability in SAPSetup, an attacker with either local user privileges or with access to a compromised corporate user�s Windows account could gain higher pri… | ||||
| CVE-2025-0068US | —OT erhöht | — | ||
An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain informati… | ||||
| CVE-2025-0067US | —OT erhöht | — | ||
Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which… | ||||
| CVE-2025-0066US | high8.8 | — | ||
Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access contr… | ||||
| CVE-2025-0063US | — | — | ||
SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges t… | ||||
| CVE-2025-0061US | critical9.1 | — | ||
SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an informat… | ||||
| CVE-2025-0059US | — | — | ||
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative… | ||||
| CVE-2025-0058US | — | — | ||
In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information t… | ||||
| CVE-2025-0057US | — | — | ||
SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS conte… | ||||
| CVE-2025-0056US | — | — | ||
SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System… | ||||
| CVE-2025-0055US | — | — | ||
SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administrative privileges or access to the victim�s… | ||||
| CVE-2025-0053US | — | — | ||
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthentica… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Source - sapexternal
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan