InfoSecBulletin Cybersecurity for mankind
SAP has issued new security patches for 19 vulnerabilities and updated 2 previous Security Notes. This Patch Day features fixes for various issues, including a high-risk authorization flaw in SAP BusinessObjects Business Intelligence.
The critical vulnerability (CVE-2025-0064, CVSS 8.7) enables an attacker with admin rights to impersonate any user in the SAP BusinessObjects Business Intelligence platform, risking sensitive data and system integrity. SAP advises customers to prioritize patching this issue to safeguard their systems.
Microsoft 2025 February Patch Tuesday fixes 2 zero-days, 55 flaws
Patch Now
SonicWall firewall vuln allows hackers to hijack VPN sessions
SAP Security Patch February 2025: Multi Vulns Addressed
TRACKING RANSOMWARE
Akira Topped January 2025 as the Most Active Ransomware Threat
FinStealer Malware Targets Indian Bank’s Mobile Users, Stealing Credentials
CVE-2024-52875
Over 12,000 Firewall Vulnerable to 1-Click RCE Exploit
CVE-2025-24200
Apple releases update of zero-day vuln exploited in the Wild
Zimbra Releases Updates for SQL Injection, XSS, and SSRF Vulns
CVE-2025-23369
SAML Bypass Auth on GitHub Enterprise Servers to Login
India to launch new domain name for banks to combat digital fraud
Other high-severity vulnerabilities addressed in this Patch Day include:
Path Traversal Vulnerability in SAP Supplier Relationship Management (CVE-2025-25243, CVSS 8.6): This flaw lets an unauthorized user access and download sensitive files.
Authentication Bypass in SAP Approuter (CVE-2025-24876, CVSS 8.1): This vulnerability allows attackers to steal user sessions and access applications without authorization.
SAP Enterprise Project Connection has several vulnerabilities (CVE-2024-38819, CVE-2024-38820, CVE-2024-38828) that could let attackers access project data and disrupt operations. SAP also updated two previous Security Notes to enhance protection against potential attacks.
SAP advises customers to review and promptly apply the latest Security Notes and patches. Prioritizing critical vulnerability patching is essential to reduce exploitation risks. Customers should also subscribe to the Security Notification Service for timely alerts on new vulnerabilities and patches.
Akira Topped January 2025 as the Most Active Ransomware Threat
