CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-2471
https://notcve.org/view.php?id=CVE-2018-2471
Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 allows an attacker to access information which would otherwise be restricted. En ciertas condiciones, SAP BusinessObjects Business Intelligence Platform, en versiones 4.10 y 4.20, permite que un atacante acceda a información que normalmente estaría restringida. • http://www.securityfocus.com/bid/105530 https://launchpad.support.sap.com/#/notes/2654905 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-2467
https://notcve.org/view.php?id=CVE-2018-2467
In the Software Development Kit in SAP BusinessObjects BI Platform Servers, versions 4.1 and 4.2, using the specially crafted URL in a Web Browser such as Chrome the system returns an error with the path of the used application server. En Software Development Kit en SAP BusinessObjects BI Platform Servers en versiones 4.1 y 4.2, el uso de una URL especialmente manipulada en un navegador web como Chrome hace que el sistema devuelva un error con la ruta del servidor de aplicación empleado. • http://www.securityfocus.com/bid/105544 https://launchpad.support.sap.com/#/notes/2623618 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-2446
https://notcve.org/view.php?id=CVE-2018-2446
Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information (server name), hence leading to an information disclosure. AdminTools en SAP BusinessObjects Business Intelligence, en versiones 4.1 y 4.2, permite que un usuario no autenticado lea información sensible (nombre del servidor), lo que conduce a una divulgación de información. • http://www.securityfocus.com/bid/105089 https://launchpad.support.sap.com/#/notes/2633846 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-2447
https://notcve.org/view.php?id=CVE-2018-2447
SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence), version 4.2, allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects database. SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence), versión 4.2, permite que un atacante ejecute consultas InfoObject manipuladas, exponiendo la base de datos CMS InfoObjects. • http://www.securityfocus.com/bid/105075 https://launchpad.support.sap.com/#/notes/2644154 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2018-2442
https://notcve.org/view.php?id=CVE-2018-2442
In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid. En SAP BusinessObjects Business Intelligence, en versiones 4.0, 4.1 y 4.2, mientras se visualiza un informe Web Intelligence del BI Launchpad, los detalles de la sesión de usuario capturados por una herramienta de análisis HTTP podrían reutilizarse en una página HTML mientras la sesión de usuario sigue siendo válida. • http://www.securityfocus.com/bid/105078 https://launchpad.support.sap.com/#/notes/2407193 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742 • CWE-352: Cross-Site Request Forgery (CSRF) •