CVSS: 9.9EPSS: 0%CPEs: 2EXPL: 0CVE-2022-41203
https://notcve.org/view.php?id=CVE-2022-41203
08 Nov 2022 — In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which leads to deserialization of untrusted data vulnerability. This could highly compromise the Confidentiality, Integrity, and Availability of the system. En algunos flujos de trabajo de la plataforma SAP BusinessObjects BI (Central Management Console y BI... • https://launchpad.support.sap.com/#/notes/3243924 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.6EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26831
https://notcve.org/view.php?id=CVE-2020-26831
09 Dec 2020 — SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure, internal directories disclosure, Server-Side Request Forgery (SSRF) and denial-of-service (DoS). SAP BusinessObjects BI Platform (Crystal Report), versiones - 4.1, 4.2, 4.3, no comprueba suficientemente las en... • https://launchpad.support.sap.com/#/notes/2989075 •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 4CVE-2020-6308
https://notcve.org/view.php?id=CVE-2020-6308
20 Oct 2020 — SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perfor... • https://github.com/InitRoot/CVE-2020-6308-PoC • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6300
https://notcve.org/view.php?id=CVE-2020-6300
12 Aug 2020 — SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator rights can use the web application to send malicious code to a different end user (victim), as it does not sufficiently encode user-controlled inputs for RecycleBin, resulting in Stored Cross-Site Scripting (XSS) vulnerability. SAP Business Objects Business Intelligence Platform (Central Management Console), versiones 4.2, 4.3, permite a un atacante con derechos de admi... • https://launchpad.support.sap.com/#/notes/2925827 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-6294
https://notcve.org/view.php?id=CVE-2020-6294
12 Aug 2020 — Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user identity. Xvfb de SAP Business Objects Business Intelligence Platform, versiones - 4.2, 4.3, una plataforma en Unix no lleva a cabo ninguna comprobación de autenticación para las funcionalidades que requieren la identidad del usuario • https://launchpad.support.sap.com/#/notes/2927956 • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-0398
https://notcve.org/view.php?id=CVE-2019-0398
11 Dec 2019 — Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to an authenticated user to send unintended request to the web server, leading to Cross Site Request Forgery. Debido a una protección CSRF insuficiente, la plataforma SAP BusinessObjects Business Intelligence (Monitoring Application), versiones anteriores a 4.1, 4.2 y 4.3, puede conllevar a que un usuario autenticado envíe peticiones no deseadas al serv... • https://launchpad.support.sap.com/#/notes/2701027 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2019-0334
https://notcve.org/view.php?id=CVE-2019-0334
14 Aug 2019 — When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed later could potentially allow a user to escalate privileges via session hijacking. The attacker could also access other sensitive information, leading to Stored Cross Site Scripting. Cuando se crea un módulo en SAP BusinessObjects Business Intelligence Platform (BI Workspace), versiones 4.1, 4.2, 4.3, es posible almacenar un scrip... • https://launchpad.support.sap.com/#/notes/2771221 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-0335
https://notcve.org/view.php?id=CVE-2019-0335
14 Aug 2019 — Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the description field in the list, when generating the little yellow informational pop up box, resulting in Stored Cross Site Scripting Attack. Bajo determinadas condiciones SAP BusinessObjects Business Intelligence Platform ... • https://launchpad.support.sap.com/#/notes/2742468 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-0332
https://notcve.org/view.php?id=CVE-2019-0332
14 Aug 2019 — SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and it will be executed while search performs its action, resulting in Cross-Site Scripting (XSS) vulnerability. SAP BusinessObjects Business Intelligence Platform (Info View), versiones 4.1, 4.2, 4.3, permite a un atacante entregar alguna carga útil para la palabra clave en la búsqueda y será ejecutada mientras la búsqueda realiza su acción, lo que result... • https://launchpad.support.sap.com/#/notes/2742468 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-0331
https://notcve.org/view.php?id=CVE-2019-0331
14 Aug 2019 — Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory structure, leading to Information Disclosure. Bajo determinadas condiciones, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versiones 4.1, 4.2, 4.3, permite a un atacante acceder a datos confidenciales tal y como la estructura de directorios, conllevando a la Divulgación de Información. • https://launchpad.support.sap.com/#/notes/2742468 •