Businessobjects (Sap) - vulnerabilities (CVEs)

23 CVEs, 0 in the last 30 days, 16 known versions, newest CVE from 2023-09-12. Vendor: Sap.

CVEs of Businessobjects

CVE-2023-40623 - CVSS 7.1 (high), 2023-09-12: SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a…
CVE-2023-28764 - CVSS 5.9 (medium), 2023-05-09: SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network. This…
CVE-2022-28214 - CVSS 7.8 (high), 2022-05-11: During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in…
CVE-2019-0303 - CVSS 6.1 (medium), 2019-06-14: SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested…
CVE-2019-0287 - CVSS 7.6 (high), 2019-05-14: Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access…
CVE-2019-0289 - CVSS 7.1 (high), 2019-05-14: Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access…
CVE-2019-0259 - CVSS 9.8 (critical), 2019-02-15: SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format…
CVE-2019-0251 - CVSS 6.1 (medium), 2019-02-15: The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site…
CVE-2018-2408 - CVSS 7.3 (high), 2018-04-10: Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for…
CVE-2017-16683 - CVSS 6.5 (medium), 2017-12-12: Denial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could allow an attacker to prevent legitimate users from accessing a…
CVE-2015-7730 - CVSS 10 (critical), 2015-10-15: SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of service…
CVE-2014-9387 - CVSS 10 (critical), 2014-12-17: SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and gain privileges via a crafted CORBA call,…
CVE-2014-8308 - CVSS 4.3 (medium), 2014-10-16: Cross-site scripting (XSS) vulnerability in the Send to Inbox functionality in SAP BusinessObjects BI EDGE 4.0 allows remote attackers to inject arbitrary web…
CVE-2014-8311 - CVSS 3.5 (low), 2014-10-16: SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener.
CVE-2014-8310 - CVSS 7.1 (high), 2014-10-16: The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted…
CVE-2014-8309 - CVSS 5 (medium), 2014-10-16: SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on…
CVE-2014-3134 - CVSS 4.3 (medium), 2014-04-30: Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via…
CVE-2010-3979 - CVSS 5 (medium), 2010-10-18: Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 generates different error messages depending on whether the Login field corresponds to a valid username,…
CVE-2010-3982 - CVSS 5 (medium), 2010-10-18: SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to trigger TCP connections to arbitrary intranet hosts on any port, and obtain potentially…
CVE-2010-3981 - CVSS 4.3 (medium), 2010-10-18: Cross-site scripting (XSS) vulnerability in SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to inject arbitrary web script or HTML via the…
CVE-2010-3980 - CVSS 4 (medium), 2010-10-18: Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 does not limit the number of CUIDs that may be requested, which allows remote authenticated users to cause…
CVE-2010-3983 - CVSS 9 (critical), 2010-10-18: CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain privileges via vectors involving the Program Job Server and the…
CVE-2010-0219 - CVSS 10 (critical), 2010-10-18: Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for…