CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6278
https://notcve.org/view.php?id=CVE-2020-6278
SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting SAP Business Objects Business Intelligence Platform (BI Launchpad y CMC), versiones 4.1, 4.2, permite a un atacante insertar scripts maliciosos en la aplicación mientras carga imágenes, que son ejecutados cuando la víctima abre estos archivos, conllevando a una vulnerabilidad de tipo Cross Site Scripting Almacenado • https://launchpad.support.sap.com/#/notes/2912708 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6269
https://notcve.org/view.php?id=CVE-2020-6269
Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure. En determinadas condiciones, SAP Business Objects Business Intelligence Platform, versión 4.2, permite a un atacante acceder a información que de otro modo estaría restringida, conllevando a una divulgación de información • https://launchpad.support.sap.com/#/notes/2905836 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-6242
https://notcve.org/view.php?id=CVE-2020-6242
SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check. SAP Business Objects Business Intelligence Platform (Live Data Connect), versiones 1.0, 2.0, 2.1, 2.2, 2.3, permite a un atacante entrar en la Central Management Console sin contraseña en caso de que el servidor de aplicaciones BIPRWS no estuviera protegido con algún certificado específico, conllevando a una Falta de Comprobación de Autenticación • https://launchpad.support.sap.com/#/notes/2885244 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 • CWE-306: Missing Authentication for Critical Function •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6257
https://notcve.org/view.php?id=CVE-2020-6257
SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. SAP Business Objects Business Intelligence Platform (CMC y BI Launchpad) versión 4.2, no codifica suficientemente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting. • https://launchpad.support.sap.com/#/notes/2907781 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6251
https://notcve.org/view.php?id=CVE-2020-6251
Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted. Bajo determinadas condiciones o escenarios de error, SAP Business Objects Business Intelligence Platform, versión 4.2, permite a un atacante acceder a información que de otro modo estaría restringida. • https://launchpad.support.sap.com/#/notes/2828558 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 •