CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-33697
https://notcve.org/view.php?id=CVE-2021-33697
15 Sep 2021 — Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. Bajo determinadas condiciones, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versiones - 420, 430, puede permitir que un atacante no autenticado redirija a usuarios a un sitio malicioso debido a las vulnerabilidades de tipo Reverse Tabnabbing • https://launchpad.support.sap.com/#/notes/3063048 • CWE-269: Improper Privilege Management CWE-1022: Use of Web Link to Untrusted Target with window.opener Access •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-33696
https://notcve.org/view.php?id=CVE-2021-33696
15 Sep 2021 — SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputs and therefore an authorized attacker can exploit a XSS vulnerability, leading to non-permanently deface or modify displayed content from a Web site. SAP BusinessObjects Business Intelligence Platform (Crystal Report), versiones - 420, 430, no codifica suficientemente las entradas controladas por el usuario y, por lo tanto, un atacante autorizado puede explotar una vul... • https://launchpad.support.sap.com/#/notes/3062085 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33679
https://notcve.org/view.php?id=CVE-2021-33679
14 Sep 2021 — The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence allowing the attacker to compromise their confidentiality and integrity. SAP BusinessObjects BI Platform versión - 420 permite a un atacante, que posee acceso básico a la aplicación, inyectar un script malicioso mien... • https://launchpad.support.sap.com/#/notes/3055180 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2021-21444
https://notcve.org/view.php?id=CVE-2021-21444
09 Feb 2021 — SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack. SAP Business Objects BI Platform, versiones - 410, 420, 430, permite múltiples entradas de encabezados X-Frame-Options en los encabezados de respuesta, que pueden no ser tratados de manera predecible por todos los agentes de... • https://launchpad.support.sap.com/#/notes/2935791 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21447
https://notcve.org/view.php?id=CVE-2021-21447
12 Jan 2021 — SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed by User who views the relevant application content, which leads to Stored Cross-Site Scripting. La plataforma SAP BusinessObjects Business Intelligence, versiones 410, 420, permite a un atacante autenticado inyectar una carga útil de JavaScript maliciosa en el campo de entrada de valor perso... • https://launchpad.support.sap.com/#/notes/2965154 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26831
https://notcve.org/view.php?id=CVE-2020-26831
09 Dec 2020 — SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure, internal directories disclosure, Server-Side Request Forgery (SSRF) and denial-of-service (DoS). SAP BusinessObjects BI Platform (Crystal Report), versiones - 4.1, 4.2, 4.3, no comprueba suficientemente las en... • https://launchpad.support.sap.com/#/notes/2989075 •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 4CVE-2020-6308
https://notcve.org/view.php?id=CVE-2020-6308
20 Oct 2020 — SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perfor... • https://github.com/InitRoot/CVE-2020-6308-PoC • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6288
https://notcve.org/view.php?id=CVE-2020-6288
09 Sep 2020 — SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload any file (including script files) without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker can modify some formulas and display erroneous content. The server is not affected only the current user browser session, that can easily be closed. SAP Business Objects Business Intelligence Platform (interfaz W... • https://launchpad.support.sap.com/#/notes/2930128 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6312
https://notcve.org/view.php?id=CVE-2020-6312
09 Sep 2020 — SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site Scripting. In certain situations, when a user accesses an affected web page element, the attacker will be able to access or modify metadata for which they are not authorized. SAP BusinessObjects Business Intelligen... • https://launchpad.support.sap.com/#/notes/2930128 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6300
https://notcve.org/view.php?id=CVE-2020-6300
12 Aug 2020 — SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator rights can use the web application to send malicious code to a different end user (victim), as it does not sufficiently encode user-controlled inputs for RecycleBin, resulting in Stored Cross-Site Scripting (XSS) vulnerability. SAP Business Objects Business Intelligence Platform (Central Management Console), versiones 4.2, 4.3, permite a un atacante con derechos de admi... • https://launchpad.support.sap.com/#/notes/2925827 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •