InfoSecBulletin Cybersecurity for mankind
SAP has issued new security patches for 19 vulnerabilities and updated 2 previous Security Notes. This Patch Day features fixes for various issues, including a high-risk authorization flaw in SAP BusinessObjects Business Intelligence.
The critical vulnerability (CVE-2025-0064, CVSS 8.7) enables an attacker with admin rights to impersonate any user in the SAP BusinessObjects Business Intelligence platform, risking sensitive data and system integrity. SAP advises customers to prioritize patching this issue to safeguard their systems.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
Other high-severity vulnerabilities addressed in this Patch Day include:
Path Traversal Vulnerability in SAP Supplier Relationship Management (CVE-2025-25243, CVSS 8.6): This flaw lets an unauthorized user access and download sensitive files.
Authentication Bypass in SAP Approuter (CVE-2025-24876, CVSS 8.1): This vulnerability allows attackers to steal user sessions and access applications without authorization.
SAP Enterprise Project Connection has several vulnerabilities (CVE-2024-38819, CVE-2024-38820, CVE-2024-38828) that could let attackers access project data and disrupt operations. SAP also updated two previous Security Notes to enhance protection against potential attacks.
SAP advises customers to review and promptly apply the latest Security Notes and patches. Prioritizing critical vulnerability patching is essential to reduce exploitation risks. Customers should also subscribe to the Security Notification Service for timely alerts on new vulnerabilities and patches.
Akira Topped January 2025 as the Most Active Ransomware Threat
