Sap Businessobjects Business Intelligence vulnerabilities, page 2
45 vulnerabilities
Known vulnerabilities in Sap Businessobjects Business Intelligence, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-35296sap_sesap businessobjects business intelligence platform (version management system)+1
EPSS score0.87%
Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive information to an actor over the network with high privileges that is not explicitly authorized to have access to that information, leading to a high impact on Confidentiality.CVE-2024-37179sap sesap businessobjects business intelligence platform (web intelligence)+1EPSS score0.43%
SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service, causing high impact on confidentiality of the application.CVE-2019-0332sap sesap businessobjects business intelligence platform (info view)+1EPSS score0.81%
SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and it will be executed while search performs its action, resulting in Cross-Site Scripting (XSS) vulnerability.CVE-2019-0346sap sesap business objects business intelligence platform (cmc)+1EPSS score0.69%
Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure.CVE-2019-0334sap sesap businessobjects business intelligence platform (bi workspace)+1EPSS score0.69%
When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed later could potentially allow a user to escalate privileges via session hijacking. The attacker could also access other sensitive information, leading to Stored Cross Site Scripting.CVE-2019-0331sap sesap businessobjects business intelligence platform (bi workspace)+1EPSS score1.11%
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory structure, leading to Information Disclosure.CVE-2019-0268sap sesap businessobjects business intelligence platform (cmc module)+1EPSS score2.20%
SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source.CVE-2019-0333sap sesap businessobjects business intelligence platform (web intelligence)+1EPSS score1.14%
In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile, resulting in Information Disclosure.CVE-2019-0335sap sesap businessobjects business intelligence platform (cmc)+1EPSS score0.81%
Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the description field in the list, when generating the little yellow informational pop up box, resulting in Stored Cross Site Scripting Attack.CVE-2019-0326sap sesap businessobjects business intelligence platform - bi workspace (enterprise)+1EPSS score1.32%
SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.CVE-2019-0348sap sesap business objects business intelligence platform (web intelligence)+1EPSS score0.69%
SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted.CVE-2019-0269sap sesap businessobjects business intelligence platform (bi workspace)+1EPSS score0.97%
SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.CVE-2023-40622sap_sesap businessobjects business intelligence platform (promotion management)+1EPSS score0.65%
SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability.CVE-2023-31406sap_sesap businessobjects business intelligence platform+1EPSS score0.46%
Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.CVE-2023-31404sap_sesap businessobjects business intelligence platform (central management service)+1EPSS score0.47%
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users with specific privileges could have access to credentials of other users. It could let them access data sources which would otherwise be restricted.CVE-2023-36917sap_sesap businessobjects business intelligence platform+1EPSS score0.58%
SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impact on integrity loss or system availability, this could lead to an attacker to completely takeover a victim’s account.CVE-2023-39440sap_sesap businessobjects business intelligence+1EPSS score0.12%
In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user credentials. For a successful attack, the attacker needs to have local access to the system. There is no impact on availability and integrity.CVE-2023-37490sap_sesap businessobjects business intelligence (installer)+1EPSS score0.27%
SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary directory during the installation process. On replacing this executable with a malicious file, an attacker can completely compromise the confidentiality, integrity, and availability of the systemCVE-2023-37489sap_sesap businessobjects business intelligence platform (version management system)+1EPSS score0.52%
Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low impact on confidentiality and no impact on the application's availability or integrity.CVE-2023-27894sapbusinessobjects_business_intelligence+1EPSS score0.62%
SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to execute malicious requests, resulting in sensitive information disclosure. This causes limited impact on confidentiality of data.