CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2018-2442
https://notcve.org/view.php?id=CVE-2018-2442
In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid. En SAP BusinessObjects Business Intelligence, en versiones 4.0, 4.1 y 4.2, mientras se visualiza un informe Web Intelligence del BI Launchpad, los detalles de la sesión de usuario capturados por una herramienta de análisis HTTP podrían reutilizarse en una página HTML mientras la sesión de usuario sigue siendo válida. • http://www.securityfocus.com/bid/105078 https://launchpad.support.sap.com/#/notes/2407193 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 0CVE-2018-2439
https://notcve.org/view.php?id=CVE-2018-2439
The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the request is validated for authenticity and validity) and under certain conditions, will process invalid requests. Several areas of the SAP Internet Graphics Server (IGS) did not require sufficient input validation. Namely, the SAP Internet Graphics Server (IGS) HTTP and RFC listener, SAP Internet Graphics Server (IGS) portwatcher when registering a portwatcher to the multiplexer and the SAP Internet Graphics Server (IGS) multiplexer had insufficient input validation and thus allowing a malformed data packet to cause a crash. SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49 y 7.53 tiene una validación insuficiente de las peticiones (por ejemplo, donde la petición se valida para la autenticidad y validez) y, en ciertas condiciones, procesará las peticiones inválidas. Varias áreas de SAP Internet Graphics Server (IGS) no requirieron una validación de entradas suficiente. • http://www.securityfocus.com/bid/104708 https://launchpad.support.sap.com/#/notes/2644147 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-2438
https://notcve.org/view.php?id=CVE-2018-2438
The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has several denial-of-service vulnerabilities that allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49 y 7.53 tiene varias vulnerabilidades de denegación de servicio (DoS) que permiten que un atacante evite que usuarios legítimos accedan a un servicio, ya sea provocando su cierre inesperado o inundándolo. • http://www.securityfocus.com/bid/104707 https://launchpad.support.sap.com/#/notes/2644238 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000 •
CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-2437
https://notcve.org/view.php?id=CVE-2018-2437
The SAP Internet Graphics Service (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to externally trigger IGS command executions which can lead to: disclosure of information and malicious file insertion or modification. SAP Internet Graphics Service (IGS), 7.20, 7.20EXT, 7.45, 7.49 y 7.53 permite que un atacante desencadene externamente la ejecución de comandos IGS, lo que puede conducir a una divulgación de información y a la inserción o modificación de archivos maliciosos. • http://www.securityfocus.com/bid/104705 https://launchpad.support.sap.com/#/notes/2644227 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000 •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-2423
https://notcve.org/view.php?id=CVE-2018-2423
SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, HTTP and RFC listener allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. En SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49 y 7.53, los escuchadores HTTP y RFC permiten que un atacante evite que usuarios legítimos accedan a un servicio, ya sea cerrando o inundando el servicio. • http://www.securityfocus.com/bid/104109 https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018 https://launchpad.support.sap.com/#/notes/2620744 •