CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6211
https://notcve.org/view.php?id=CVE-2020-6211
14 Apr 2020 — SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect users to a malicious site due to insufficient URL validation and steal credentials of the victim, leading to URL Redirection vulnerability. SAP Business Objects Business Intelligence Platform (AdminTools), versiones 4.1, 4.2, permite a un atacante redireccionar a usuarios hacia un sitio malicioso debido a una comprobación insuficiente de la URL y al robo de credenciales de la víctima, conlleva... • https://launchpad.support.sap.com/#/notes/2878507 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6195
https://notcve.org/view.php?id=CVE-2020-6195
14 Apr 2020 — SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to read/modify delete the data and rights within the system. SAP Business Objects Business Intelligence Platform (CMC), versión 4.1, 4.2, muestra la contraseña de texto plano en la respuesta, conllevando a una Divul... • https://launchpad.support.sap.com/#/notes/2878507 • CWE-319: Cleartext Transmission of Sensitive Information CWE-522: Insufficiently Protected Credentials •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6237
https://notcve.org/view.php?id=CVE-2020-6237
14 Apr 2020 — Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web application allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure. Bajo determinadas condiciones, en SAP Business Objects Business Intelligence Platform, versión 4.1, 4.2, la aplicación web dswsbobje permite a un atacante acceder a información que de otra manera estaría restringida, conllevando a una Divulgación de Información. • https://launchpad.support.sap.com/#/notes/2898077 •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6226
https://notcve.org/view.php?id=CVE-2020-6226
14 Apr 2020 — SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. SAP Business Objects Business Intelligence Platform (interfaz Web Intelligence HTML), versión 4.2, no codifica suficientemente las entradas controladas por el usuario, resultando en vulnerabilidad de tipo Cross-Site Scripting (XSS). • https://launchpad.support.sap.com/#/notes/2879132 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6231
https://notcve.org/view.php?id=CVE-2020-6231
14 Apr 2020 — SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. SAP Business Objects Business Intelligence Platform (interfaz Web Intelligence HTML), versión 4.2, no codifica suficientemente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting (XSS). • https://launchpad.support.sap.com/#/notes/2879132 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6227
https://notcve.org/view.php?id=CVE-2020-6227
14 Apr 2020 — SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP packets to several services due to Improper Input Validation, allowing to forge additional entries in GLF log files. SAP Business Objects Business Intelligence Platform (problemas de CMS / Auditing), versión 4.2, permite a un atacante enviar paquetes GIOP especialmente diseñados hacia varios servicios debido a una Comprobación de Entrada Inapropiada, permitiendo falsificar... • https://launchpad.support.sap.com/#/notes/2863396 • CWE-20: Improper Input Validation CWE-116: Improper Encoding or Escaping of Output •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-6219
https://notcve.org/view.php?id=CVE-2020-6219
14 Apr 2020 — SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service and unauthorized execution of arbitrary commands, leading to Deserialization of Untrusted Data. SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versiones 4.1, 4.2 y Crystal Repo... • https://launchpad.support.sap.com/#/notes/2863731 • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6222
https://notcve.org/view.php?id=CVE-2020-6222
14 Apr 2020 — SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. SAP Business Objects Business Intelligence Platform (interfaz Web Intelligence HTML), versiones 4.1, 4.2, no codifica suficientemente las entradas controladas por el usuario, resultando en vulnerabilidad de tipo Cross-Site Scripting (XSS). • https://launchpad.support.sap.com/#/notes/2880804 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6216
https://notcve.org/view.php?id=CVE-2020-6216
14 Apr 2020 — SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability. SAP Business Objects Business Intelligence Platform (BI Launchpad), versión 4.2, no codifica suficientemente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting (XSS) reflejada. • https://launchpad.support.sap.com/#/notes/2876059 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6221
https://notcve.org/view.php?id=CVE-2020-6221
14 Apr 2020 — Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. La interfaz Web Intelligence HTML en SAP Business Objects Business Intelligence Platform, versiones 4.1, 4.2, no codifica suficientemente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting (XSS). • https://launchpad.support.sap.com/#/notes/2878507 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •