CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6223
https://notcve.org/view.php?id=CVE-2020-6223
14 Apr 2020 — The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malicious content. This can misdirect a user who is tricked into accessing these error pages rendered by the application, leading to Content Spoofing. El documento abierto de SAP Business Objects Business Intelligence Platform, versiones 4.1, 4.2, permite a un atacante modificar determinadas páginas de error para incluir contenido malicioso. Esto puede desv... • https://launchpad.support.sap.com/#/notes/2878507 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6218
https://notcve.org/view.php?id=CVE-2020-6218
14 Apr 2020 — Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should otherwise be restricted, leading to Information Disclosure. Las herramientas de administración y el Query Builder en SAP Business Objects Business Intelligence Platform, versiones 4.1, 4.2, permiten a un atacante acceder a información que de otra manera debería estar restringida, conllevando a una divulgación de información. • https://launchpad.support.sap.com/#/notes/2878507 •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6189
https://notcve.org/view.php?id=CVE-2020-6189
12 Feb 2020 — Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure. Determinadas páginas de configuración en SAP Business Objects Business Intelligence Platform (CMC), versión 4.2, genera mensajes de error que pueden proporcionar información relacionada con la red privada de la empresa que de otro modo se restringiría, co... • https://launchpad.support.sap.com/#/notes/2695210 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-0398
https://notcve.org/view.php?id=CVE-2019-0398
11 Dec 2019 — Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to an authenticated user to send unintended request to the web server, leading to Cross Site Request Forgery. Debido a una protección CSRF insuficiente, la plataforma SAP BusinessObjects Business Intelligence (Monitoring Application), versiones anteriores a 4.1, 4.2 y 4.3, puede conllevar a que un usuario autenticado envíe peticiones no deseadas al serv... • https://launchpad.support.sap.com/#/notes/2701027 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-0395
https://notcve.org/view.php?id=CVE-2019-0395
11 Dec 2019 — SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI Launchpad, leading to Stored Cross Site Scripting vulnerability. La plataforma SAP BusinessObjects Business Intelligence (Fiori BI Launchpad), versiones anteriores a 4.2, permite una ejecución de JavaScript en un módulo de texto en Fiori BI Launchpad, lo que conlleva a una vulnerabilidad de tipo Cross Site Scripting Almacenada. • https://launchpad.support.sap.com/#/notes/2830578 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-0396
https://notcve.org/view.php?id=CVE-2019-0396
13 Nov 2019 — SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML document accepted from an untrusted source. An attacker can craft a message that contains malicious elements that will not be correctly filtered by Web Intelligence HTML interface in some specific workflows. SAP BusinessObjects Business Intelligence Platform (interfaz HTML de Web Intelligence), corregida en las versiones 4.1 y 4.2, no comprueba sufici... • https://launchpad.support.sap.com/#/notes/2814007 • CWE-20: Improper Input Validation •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-0382
https://notcve.org/view.php?id=CVE-2019-0382
13 Nov 2019 — A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related pages); corrected in version 4.2. Privileges are required in order to exploit this vulnerability. Existe una vulnerabilidad de tipo Cross-Site Scripting en SAP BusinessObjects Business Intelligence Platform (páginas relacionadas con Web Intelligence-Publication); corregido en la versión 4.2. Se requieren privilegios para explotar esta vulnerabilidad. • https://launchpad.support.sap.com/#/notes/2817937 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2019-0378
https://notcve.org/view.php?id=CVE-2019-0378
08 Oct 2019 — SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting. SAP BusinessObjects Business Intelligence Platform (interfaz Web Intelligence HTML), versiones anteriores a 4.2, no codifica suficientemente las entradas controladas por el usuario y permite a un atacante almacenar script... • https://launchpad.support.sap.com/#/notes/2817945 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2019-0377
https://notcve.org/view.php?id=CVE-2019-0377
08 Oct 2019 — SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting. SAP BusinessObjects Business Intelligence Platform (interfaz Web Intelligence HTML), versiones anteriores a 4.2, no codifica suficientemente las entradas controladas por el usuario y permite a un atacante almacenar scripts maliciosos en l... • https://launchpad.support.sap.com/#/notes/2817945 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 9EXPL: 0CVE-2019-0376
https://notcve.org/view.php?id=CVE-2019-0376
08 Oct 2019 — SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in the publication name, which can be executed later by the victim, resulting in Stored Cross-Site Scripting. SAP BusinessObjects Business Intelligence Platform (interfaz Web Intelligence HTML), versiones anteriores a 4.2 y 4.3, no codifica suficientemente las entradas controladas por el usuario... • https://launchpad.support.sap.com/#/notes/2817945 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •