EUVD-2018-7085

Malware in sbrugna...

EUVD-2018-7086

Malware in sbrugna...

CVE-2018-15206

BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf...

CVE-2018-15208

BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter...

Session fixation

BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter...

Improper access control

BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pages/finadmin/currconvrate/currconvrate.jsf functionality that should be only accessible to an admin...

CVE-2018-15207

BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pages/finadmin/currconvrate/currconvrate.jsf functionality that should be only accessible to an admin...

CVE-2018-15207

The CVE-2018-15207 entry concerns BPC SmartVista 2, specifically the SVFE module. Affected component: SVFE2/pages/finadmin/currconvrate/currconvrate.jsf. Root cause: Improper access control that allows a normal user to access functionality intended for admins. Impact stated in CVSS metrics is hig...

CVE-2018-15206

CVE-2018-15206 affects BPC SmartVista 2 with a CSRF flaw exposed at SVFE2/pages/admpages/roles/createrole.jsf. CVSSv3 indicates HIGH impact (8.8) with network attack, low complexity, no privileges, but requires user interaction; confidentiality, integrity, and availability are rated HIGH. No reme...

PT-2019-9094

Name of the Vulnerable Software and Affected Versions BPC SmartVista 2 Description The issue is related to a CSRF problem. It affects the /SVFE2/pages/admpages/roles/createrole.jsf API endpoint. Recommendations For BPC SmartVista 2, consider implementing proper CSRF protection mechanisms to preve...

CVE-2018-15207: Improper Privilege Management

BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pages/finadmin/currconvrate/currconvrate.jsf functionality that should be only accessible to an admin...

CVE-2018-15208: Session Fixation

BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter...

CVE-2018-15206: Cross-Site Request Forgery (CSRF)

BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf...

PT-2019-9095

Name of the Vulnerable Software and Affected Versions BPC SmartVista 2 Description The issue is related to improper access control in the SVFE module. A normal user can access the "SVFE2/pages/finadmin/currconvrate/currconvrate.jsf" functionality, which should only be accessible to an admin...