CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-2467
https://notcve.org/view.php?id=CVE-2018-2467
09 Oct 2018 — In the Software Development Kit in SAP BusinessObjects BI Platform Servers, versions 4.1 and 4.2, using the specially crafted URL in a Web Browser such as Chrome the system returns an error with the path of the used application server. En Software Development Kit en SAP BusinessObjects BI Platform Servers en versiones 4.1 y 4.2, el uso de una URL especialmente manipulada en un navegador web como Chrome hace que el sistema devuelva un error con la ruta del servidor de aplicación empleado. • http://www.securityfocus.com/bid/105544 •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-2472
https://notcve.org/view.php?id=CVE-2018-2472
09 Oct 2018 — SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 (Web Intelligence DHTML client) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. SAP BusinessObjects Business Intelligence Platform 4.20 y 4.20 (cliente Web Intelligence DHTML) no cifra lo suficiente las entradas controladas por el usuario, lo que resulta en una vulnerabilidad Cross-Site Scripting (XSS). • http://www.securityfocus.com/bid/105531 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2018-2442
https://notcve.org/view.php?id=CVE-2018-2442
14 Aug 2018 — In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid. En SAP BusinessObjects Business Intelligence, en versiones 4.0, 4.1 y 4.2, mientras se visualiza un informe Web Intelligence del BI Launchpad, los detalles de la sesión de usuario capturados por una herramienta de análisis HTTP podrían reutilizarse en... • http://www.securityfocus.com/bid/105078 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-2446
https://notcve.org/view.php?id=CVE-2018-2446
14 Aug 2018 — Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information (server name), hence leading to an information disclosure. AdminTools en SAP BusinessObjects Business Intelligence, en versiones 4.1 y 4.2, permite que un usuario no autenticado lea información sensible (nombre del servidor), lo que conduce a una divulgación de información. • http://www.securityfocus.com/bid/105089 •
CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 0CVE-2018-2445
https://notcve.org/view.php?id=CVE-2018-2445
14 Aug 2018 — AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting in a Server-Side Request Forgery (SSRF) vulnerability. AdminTools en SAP BusinessObjects Business Intelligence, en versiones 4.1 y 4.2, permite que un atacante manipule la aplicación vulnerable para enviar peticiones manipuladas en nombre de la aplicación, lo que resulta en una vulnerabilidad de SSRF (Server-S... • http://www.securityfocus.com/bid/105064 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-2447
https://notcve.org/view.php?id=CVE-2018-2447
14 Aug 2018 — SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence), version 4.2, allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects database. SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence), versión 4.2, permite que un atacante ejecute consultas InfoObject manipuladas, exponiendo la base de datos CMS InfoObjects. • http://www.securityfocus.com/bid/105075 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2018-2432
https://notcve.org/view.php?id=CVE-2018-2432
10 Jul 2018 — SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including: cross-site scripting and page hijacking. SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) 4.10, 4.20 y 4.30 permite que un atacante incluya datos no validados en la cabecera d... • http://www.securityfocus.com/bid/104716 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-2408
https://notcve.org/view.php?id=CVE-2018-2408
10 Apr 2018 — Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be active. Gestión incorrecta de sesión en SAP Business Objects, en su versión 4.0, desde la versión 4.20, 4.30, en CMC/BI Launchpad/Fiorified BI Launchpad. En el caso de que se cambie la contraseña de un usuario, el resto de sesiones activas creadas con la contraseña antigua s... • http://www.securityfocus.com/bid/103700 • CWE-384: Session Fixation •