Sap Businessobjects Business Intelligence Platform vulnerabilities, page 3

74 vulnerabilities

Known vulnerabilities in Sap Businessobjects Business Intelligence Platform, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3MediumCVE-2022-39014sap se · sap businessobjects business intelligence platform (cmc) +1 moresap se sap businessobjects business intelligence platform (cmc)Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attacker to access certain unencrypted sensitive parameters which would otherwise be restricted.EPSS0.46%6.5MediumCVE-2022-29619sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformUnder certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of objects it doesn't own and which would otherwise be restricted.EPSS0.90%7.5HighCVE-2022-27667sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformUnder certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure.EPSS1.36%6.5MediumCVE-2022-27671sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformA CSRF token visible in the URL may possibly lead to information disclosure vulnerability.EPSS1.29%6.5MediumCVE-2022-22541sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformSAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational or OLAP connections. The main impact is the disclosure of company data to people that shouldn't or don't need to have access.EPSS0.79%8.1HighCVE-2022-28213sap_se · sap businessobjects business intelligence platform +1 moresap_se sap businessobjects business intelligence platformWhen a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.EPSS12.48%6.1MediumCVE-2022-28216sap se · sap businessobjects business intelligence platform (bi workspace) +1 moresap se sap businessobjects business intelligence platform (bi workspace)SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unauthenticated attacker due to improper sanitization of the user inputs on the network. On successful exploitation, an attacker can access certain reports causing a limited impact on confidentiality of the application data.EPSS0.83%8.8HighCVE-2022-35228sap se · sap businessobjects business intelligence platform (central management console) +1 moresap se sap businessobjects business intelligence platform (central management console)SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be achieved only when a legitimate user accesses the application and a local compromise occurs, like sniffing or social engineering. On successful exploitation, the attacker can completely compromise the application.EPSS0.54%6.5MediumCVE-2022-35169sap se · sap businessobjects business intelligence platform (lcm) +1 moresap se sap businessobjects business intelligence platform (lcm)SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privilege to read and decrypt LCMBIAR file's password under certain conditions, enabling the attacker to modify the password or import the file into another system causing high impact on confidentiality but a limited impact on the availability and integrity of the application.EPSS0.68%5.8MediumCVE-2024-45281sap_se · sap businessobjects business intelligence platform +1 moreDLL hijacking vulnerability in SAP BusinessObjects Business Intelligence PlatformSAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally signed or if the signature is broken. The attacker needs to have local access to the vulnerable system to perform DLL related tasks. This could result in a high impact on confidentiality and integrity of the application.EPSS0.16%9.3CriticalCVE-2024-28165sap_se · sap businessobjects business intelligence platform +1 moreCross site scripting vulnerability in SAP BusinessObjects Business Intelligence PlatformSAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the applicationEPSS0.56%5.3MediumCVE-2024-32732sap_se · sap businessobjects business intelligence platform +1 moreInformation Disclosure vulnerability in SAP BusinessObjects Business Intelligence platformUnder certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This has low impact on Confidentiality with no impact on Integrity and Availability of the application.EPSS0.32%6MediumCVE-2024-34684sap_se · sap businessobjects business intelligence platform +1 moreInformation Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Scheduling)On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to access the password of a local account. As a result, an attacker can obtain non-administrative user credentials, which will allow them to read or modify the remote server files.EPSS0.14%4.3MediumCVE-2024-33004sap_se · sap businessobjects business intelligence platform (webservices) +1 moreInsecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache and can open the pages causing limited impact on Confidentiality, Integrity and Availability of the application.EPSS0.24%7.5HighCVE-2019-0352sap se · sap businessobjects business intelligence platform (cmc) +1 moresap se sap businessobjects business intelligence platform (cmc)In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the sensitive information via cache and can open the dynamic pages even after logout.EPSS1.08%7.1HighCVE-2019-0396sap_se · sap businessobjects business intelligence platform (web intelligence html interface) +1 moresap_se sap businessobjects business intelligence platform (web intelligence html interface)SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML document accepted from an untrusted source. An attacker can craft a message that contains malicious elements that will not be correctly filtered by Web Intelligence HTML interface in some specific workflows.EPSS0.90%5.4MediumCVE-2019-0377sap_se · sap businessobjects business intelligence platform (web intelligence html interface) +1 moresap_se sap businessobjects business intelligence platform (web intelligence html interface)SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting.EPSS0.53%5.4MediumCVE-2019-0375sap_se · sap businessobjects business intelligence platform (web intelligence html interface) +1 moresap_se sap businessobjects business intelligence platform (web intelligence html interface)SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the export dialog box of the report name resulting in reflected Cross-Site Scripting.EPSS0.73%8.8HighCVE-2019-0398sap se · sap businessobjects business intelligence platform (monitoring application) +1 moresap se sap businessobjects business intelligence platform (monitoring application)Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to an authenticated user to send unintended request to the web server, leading to Cross Site Request Forgery.EPSS0.45%5.4MediumCVE-2019-0378sap_se · sap businessobjects business intelligence platform (web intelligence html interface) +1 moresap_se sap businessobjects business intelligence platform (web intelligence html interface)SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting.EPSS0.53%