Businessobjects Business Intelligence Platform (Sap) - vulnerabilities (CVEs)

73 CVEs, 0 in the last 30 days, 43 known versions, newest CVE from 2026-02-10. Vendor: Sap.

CVEs of Businessobjects Business Intelligence Platform

CVE-2026-24324 - CVSS 6.5 (medium), 2026-02-10: SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in…
CVE-2026-0508 - CVSS 8.1 (high), 2026-02-10: The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application.…
CVE-2026-0490 - CVSS 7.5 (high), 2026-02-10: SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication,…
CVE-2026-0485 - CVSS 7.5 (high), 2026-02-10: SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to…
CVE-2025-42988 - CVSS 5.3 (medium), 2025-06-10: Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal…
CVE-2025-31332 - CVSS 7.1 (high), 2025-04-08: Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files…
CVE-2025-25245 - CVSS 6.1 (medium), 2025-03-11: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured. An attacker…
CVE-2025-0064 - CVSS 8.7 (high), 2025-02-11: Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to…
CVE-2025-0061 - CVSS 9.1 (critical), 2025-01-14: SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user…
CVE-2025-0060 - CVSS 6.5 (medium), 2025-01-14: SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive…
CVE-2024-32732 - CVSS 5.3 (medium), 2024-12-10: Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This…
CVE-2024-45281 - CVSS 5.8 (medium), 2024-09-10: SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally…
CVE-2024-34684 - CVSS 6 (medium), 2024-06-11: On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to…
CVE-2024-33004 - CVSS 4.3 (medium), 2024-05-14: SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On…
CVE-2024-28165 - CVSS 9.3 (critical), 2024-05-14: SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which…
CVE-2023-42472 - CVSS 8.7 (high), 2023-09-12: Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report…
CVE-2023-27271 - CVSS 7.5 (high), 2023-03-14: In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the…
CVE-2023-24530 - CVSS 9.1 (critical), 2023-02-14: SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed…
CVE-2023-0020 - CVSS 8.5 (high), 2023-02-14: SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise…
CVE-2023-0022 - CVSS 9.9 (critical), 2023-01-10: SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the…
CVE-2023-0018 - CVSS 10 (critical), 2023-01-10: Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an…
CVE-2022-41267 - CVSS 9.9 (critical), 2022-12-13: SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server…
CVE-2022-39014 - CVSS 5.3 (medium), 2022-09-13: Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attacker to access…
CVE-2022-35228 - CVSS 8.8 (high), 2022-07-12: SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be…
CVE-2022-35169 - CVSS 6 (medium), 2022-07-12: SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privilege to read and decrypt LCMBIAR file's…
CVE-2022-29619 - CVSS 6.5 (medium), 2022-07-12: Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of…
CVE-2022-27671 - CVSS 6.5 (medium), 2022-04-12: A CSRF token visible in the URL may possibly lead to information disclosure vulnerability.
CVE-2022-27667 - CVSS 7.5 (high), 2022-04-12: Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access…
CVE-2022-28216 - CVSS 6.1 (medium), 2022-04-12: SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unauthenticated…
CVE-2022-28213 - CVSS 8.1 (high), 2022-04-12: When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML…
CVE-2022-22541 - CVSS 6.5 (medium), 2022-04-12: SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational…
CVE-2021-42061 - CVSS 5.4 (medium), 2021-12-14: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in…
CVE-2021-40500 - CVSS 7.5 (high), 2021-10-12: SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML…
CVE-2021-33679 - CVSS 5.4 (medium), 2021-09-14: The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a…
CVE-2020-26831 - CVSS 9.6 (critical), 2020-12-09: SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report…
CVE-2020-6308 - CVSS 5.3 (medium), 2020-10-20: SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as…
CVE-2020-6312 - CVSS 5.4 (medium), 2020-09-09: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), versions - 4.1, 4.2, allows an attacker with a non-administrative user…
CVE-2020-6288 - CVSS 5.3 (medium), 2020-09-09: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload any file…
CVE-2020-6300 - CVSS 4.8 (medium), 2020-08-12: SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator rights can use the…
CVE-2020-6294 - CVSS 9.1 (critical), 2020-08-12: Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for…
CVE-2020-6278 - CVSS 5.4 (medium), 2020-07-14: SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the…
CVE-2020-6276 - CVSS 6.1 (medium), 2020-07-14: SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site…
CVE-2020-6281 - CVSS 6.1 (medium), 2020-07-14: SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in…
CVE-2020-6269 - CVSS 6.5 (medium), 2020-06-10: Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be…
CVE-2020-6245 - CVSS 6.7 (medium), 2020-05-12: SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be…
CVE-2020-6257 - CVSS 5.4 (medium), 2020-05-12: SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site…
CVE-2020-6251 - CVSS 6.5 (medium), 2020-05-12: Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which…
CVE-2020-6247 - CVSS 7.5 (high), 2020-05-12: SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service.…
CVE-2020-6242 - CVSS 9.8 (critical), 2020-05-12: SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central…
CVE-2020-6211 - CVSS 6.1 (medium), 2020-04-14: SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect users to a malicious site due to…
CVE-2020-6195 - CVSS 9.8 (critical), 2020-04-14: SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It…
CVE-2020-6237 - CVSS 7.5 (high), 2020-04-14: Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web application allows an attacker to access…
CVE-2020-6216 - CVSS 6.1 (medium), 2020-04-14: SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected…
CVE-2020-6221 - CVSS 5.4 (medium), 2020-04-14: Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled…
CVE-2020-6226 - CVSS 5.4 (medium), 2020-04-14: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs,…
CVE-2020-6219 - CVSS 9.1 (critical), 2020-04-14: SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an…
CVE-2020-6223 - CVSS 6.1 (medium), 2020-04-14: The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include…
CVE-2020-6231 - CVSS 5.4 (medium), 2020-04-14: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs,…
CVE-2020-6218 - CVSS 5 (medium), 2020-04-14: Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should…
CVE-2020-6222 - CVSS 5.4 (medium), 2020-04-14: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not sufficiently encode user-controlled inputs,…
CVE-2020-6227 - CVSS 7.5 (high), 2020-04-14: SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP packets to several…
CVE-2020-6189 - CVSS 5.3 (medium), 2020-02-12: Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise…
CVE-2019-0395 - CVSS 5.4 (medium), 2019-12-11: SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI…
CVE-2019-0398 - CVSS 8.8 (high), 2019-12-11: Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead…
CVE-2019-0396 - CVSS 7.1 (high), 2019-11-13: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML…
CVE-2019-0382 - CVSS 5.4 (medium), 2019-11-13: A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related pages); corrected in…
CVE-2019-0374 - CVSS 5.4 (medium), 2019-10-08: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode…
CVE-2019-0377 - CVSS 5.4 (medium), 2019-10-08: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs…
CVE-2019-0376 - CVSS 5.4 (medium), 2019-10-08: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode…
CVE-2019-0375 - CVSS 5.4 (medium), 2019-10-08: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode…
CVE-2019-0378 - CVSS 5.4 (medium), 2019-10-08: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs…
CVE-2019-0352 - CVSS 7.5 (high), 2019-09-10: In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker…
CVE-2018-2471 - CVSS 7.5 (high), 2018-10-09: Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 allows an attacker to access information which would otherwise be…
CVE-2018-2397 - CVSS 5.4 (medium), 2018-03-14: In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) does not sufficiently encode user…