CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6269
https://notcve.org/view.php?id=CVE-2020-6269
10 Jun 2020 — Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure. En determinadas condiciones, SAP Business Objects Business Intelligence Platform, versión 4.2, permite a un atacante acceder a información que de otro modo estaría restringida, conllevando a una divulgación de información • https://launchpad.support.sap.com/#/notes/2905836 •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-6242
https://notcve.org/view.php?id=CVE-2020-6242
12 May 2020 — SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check. SAP Business Objects Business Intelligence Platform (Live Data Connect), versiones 1.0, 2.0, 2.1, 2.2, 2.3, permite a un atacante entrar en la Central Management Console sin contraseña en caso d... • https://launchpad.support.sap.com/#/notes/2885244 • CWE-306: Missing Authentication for Critical Function •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6257
https://notcve.org/view.php?id=CVE-2020-6257
12 May 2020 — SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. SAP Business Objects Business Intelligence Platform (CMC y BI Launchpad) versión 4.2, no codifica suficientemente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting. • https://launchpad.support.sap.com/#/notes/2907781 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6251
https://notcve.org/view.php?id=CVE-2020-6251
12 May 2020 — Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted. Bajo determinadas condiciones o escenarios de error, SAP Business Objects Business Intelligence Platform, versión 4.2, permite a un atacante acceder a información que de otro modo estaría restringida. • https://launchpad.support.sap.com/#/notes/2828558 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6247
https://notcve.org/view.php?id=CVE-2020-6247
12 May 2020 — SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service. Using a specially crafted request, the attacker can crash or flood the Central Management Server, thereby impacting system availability. SAP Business Objects Business Intelligence Platform, versión 4.2, permite a un atacante no autenticado impedir a usuarios legítimos acceder a un servicio. Usando una petición especialmente diseñada, el atacante puede blo... • https://launchpad.support.sap.com/#/notes/2828558 •
CVSS: 6.7EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6245
https://notcve.org/view.php?id=CVE-2020-6245
12 May 2020 — SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers. SAP Business Objects Business Intelligence Platform, versión 4.2, permite a un atacante con acceso a la instancia local inyectar un archivo o código que puede ser ejecutado por la aplicación debido a un Control Inapropiado de los Identificadores de Recursos. • https://launchpad.support.sap.com/#/notes/2828558 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-99: Improper Control of Resource Identifiers ('Resource Injection') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6211
https://notcve.org/view.php?id=CVE-2020-6211
14 Apr 2020 — SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect users to a malicious site due to insufficient URL validation and steal credentials of the victim, leading to URL Redirection vulnerability. SAP Business Objects Business Intelligence Platform (AdminTools), versiones 4.1, 4.2, permite a un atacante redireccionar a usuarios hacia un sitio malicioso debido a una comprobación insuficiente de la URL y al robo de credenciales de la víctima, conlleva... • https://launchpad.support.sap.com/#/notes/2878507 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6195
https://notcve.org/view.php?id=CVE-2020-6195
14 Apr 2020 — SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to read/modify delete the data and rights within the system. SAP Business Objects Business Intelligence Platform (CMC), versión 4.1, 4.2, muestra la contraseña de texto plano en la respuesta, conllevando a una Divul... • https://launchpad.support.sap.com/#/notes/2878507 • CWE-319: Cleartext Transmission of Sensitive Information CWE-522: Insufficiently Protected Credentials •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6237
https://notcve.org/view.php?id=CVE-2020-6237
14 Apr 2020 — Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web application allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure. Bajo determinadas condiciones, en SAP Business Objects Business Intelligence Platform, versión 4.1, 4.2, la aplicación web dswsbobje permite a un atacante acceder a información que de otra manera estaría restringida, conllevando a una Divulgación de Información. • https://launchpad.support.sap.com/#/notes/2898077 •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6226
https://notcve.org/view.php?id=CVE-2020-6226
14 Apr 2020 — SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. SAP Business Objects Business Intelligence Platform (interfaz Web Intelligence HTML), versión 4.2, no codifica suficientemente las entradas controladas por el usuario, resultando en vulnerabilidad de tipo Cross-Site Scripting (XSS). • https://launchpad.support.sap.com/#/notes/2879132 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •