CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6300
https://notcve.org/view.php?id=CVE-2020-6300
SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator rights can use the web application to send malicious code to a different end user (victim), as it does not sufficiently encode user-controlled inputs for RecycleBin, resulting in Stored Cross-Site Scripting (XSS) vulnerability. SAP Business Objects Business Intelligence Platform (Central Management Console), versiones 4.2, 4.3, permite a un atacante con derechos de administrador poder usar la aplicación web para enviar código malicioso hacia un usuario final diferente (víctima), ya que no codifica suficientemente a las entradas controladas por el usuario para RecycleBin, resultando en una vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenado • https://launchpad.support.sap.com/#/notes/2925827 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-6294
https://notcve.org/view.php?id=CVE-2020-6294
Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user identity. Xvfb de SAP Business Objects Business Intelligence Platform, versiones - 4.2, 4.3, una plataforma en Unix no lleva a cabo ninguna comprobación de autenticación para las funcionalidades que requieren la identidad del usuario • https://launchpad.support.sap.com/#/notes/2927956 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 • CWE-306: Missing Authentication for Critical Function •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6276
https://notcve.org/view.php?id=CVE-2020-6276
SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. SAP Business Objects Business Intelligence Platform (bipodata), versión 4.2, no codifica suficientemente unas entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting • https://launchpad.support.sap.com/#/notes/2849967 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6281
https://notcve.org/view.php?id=CVE-2020-6281
SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in Cross-Site Scripting. SAP Business Objects Business Intelligence Platform (BI Launchpad), versión 4.2, no codifica suficientemente unas entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting • https://launchpad.support.sap.com/#/notes/2917743 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6278
https://notcve.org/view.php?id=CVE-2020-6278
SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting SAP Business Objects Business Intelligence Platform (BI Launchpad y CMC), versiones 4.1, 4.2, permite a un atacante insertar scripts maliciosos en la aplicación mientras carga imágenes, que son ejecutados cuando la víctima abre estos archivos, conllevando a una vulnerabilidad de tipo Cross Site Scripting Almacenado • https://launchpad.support.sap.com/#/notes/2912708 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •