CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-33004 – Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)
https://notcve.org/view.php?id=CVE-2024-33004
SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache and can open the pages causing limited impact on Confidentiality, Integrity and Availability of the application. SAP Business Objects Business Intelligence Platform es vulnerable al almacenamiento inseguro, ya que las páginas web dinámicas se almacenan en caché incluso después de cerrar la sesión. Si la explotación tiene éxito, el atacante puede ver la información confidencial a través del caché y abrir las páginas, lo que provoca un impacto limitado en la confidencialidad, la integridad y la disponibilidad de la aplicación. • https://me.sap.com/notes/3449093 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html • CWE-524: Use of Cache Containing Sensitive Information CWE-922: Insecure Storage of Sensitive Information •
CVSS: 4.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-33009 – SQL injection vulnerability in SAP Global Label Management (GLM)
https://notcve.org/view.php?id=CVE-2024-33009
SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify database commands resulting in the retrieval of additional information persisted by the system. This could lead to low impact on Confidentiality and Integrity of the application. SAP Global Label Management es vulnerable a la inyección SQL. Tras la explotación, el atacante puede utilizar entradas especialmente manipuladas para modificar los comandos de la base de datos, lo que da como resultado la recuperación de información adicional conservada por el sistema. • https://me.sap.com/notes/1938764 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4138 – Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)
https://notcve.org/view.php?id=CVE-2024-4138
Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can enable/disable the sharing rule of other users affecting the integrity of the application. Confidentiality and Availability are not affected. Manage Bank Statement ReProcessing Rules no realiza las verificaciones de autorización necesarias para un usuario autenticado, lo que resulta en una escalada de privilegios. Al explotar esta vulnerabilidad, un atacante puede habilitar/deshabilitar la regla de uso compartido de otros usuarios que afecta la integridad de la aplicación. • https://me.sap.com/notes/3434666 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4139 – Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)
https://notcve.org/view.php?id=CVE-2024-4139
Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can delete rules of other users affecting the integrity of the application. Confidentiality and Availability are not affected. Manage Bank Statement ReProcessing Rules no realiza las verificaciones de autorización necesarias para un usuario autenticado, lo que resulta en una escalada de privilegios. Al explotar esta vulnerabilidad, un atacante puede eliminar reglas de otros usuarios que afecten la integridad de la aplicación. • https://me.sap.com/notes/3434666 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html • CWE-862: Missing Authorization •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-28165 – Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform
https://notcve.org/view.php?id=CVE-2024-28165
SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the application La plataforma SAP Business Objects Business Intelligence es vulnerable al XSS almacenado, lo que permite a un atacante manipular un parámetro en la URL de Opendocument, lo que podría tener un alto impacto en la confidencialidad y la integridad de la aplicación. • https://me.sap.com/notes/3431794 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •