High WID-SEC-2025-2006 3 CVEs

Microsoft SQL Server: Mehrere Schwachstellen

Published Sep 9, 2025 · Updated Sep 9, 2025 · de-DE

Vendor: Microsoft Product: SQL Server 2016 Product: SQL Server 2017 Product: SQL Server 2019 Product: SQL Server 2022 Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Microsoft SQL Server ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, und um nicht näher spezifizierte Auswirkungen zu verursachen.

Product

Der Microsoft SQL Server ist ein relationales Datenbankmanagementsystem von Microsoft.

Vulnerabilities 3

High 8.8

CVE-2025-55227

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Sep 9, 2025
High 7.5

CVE-2024-21907 Public exploit EPSS 33%

Improper Handling of Exceptional Conditions in Newtonsoft.Json

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending…

Newtonsoft.Json newtonsoft-json Ubuntu NuGet

Jan 3, 2024
Medium 6.5

CVE-2025-47997

Microsoft SQL Server Information Disclosure Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Sep 9, 2025

Revision history

2025-09-09 #1
Initiale Fassung

References

Microsoft Leitfaden für Sicherheitsupdates
https://msrc.microsoft.com/update-guide/