CVE-2018-2444

SAP BusinessObjects Financial Consolidation, versions 10.0, 10.1, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2445

AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting in a Server-Side Request Forgery SSRF vulnerability...

CVE-2018-2442

In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid...

CVE-2018-2444

SAP BusinessObjects Financial Consolidation, versions 10.0, 10.1, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2445

AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting in a Server-Side Request Forgery SSRF vulnerability...

CVE-2018-2446

Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information server name, hence leading to an information disclosure...

CVE-2018-2447

SAP BusinessObjects Business Intelligence Launchpad Web Intelligence, version 4.2, allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects database...

CVE-2018-2442

Summary of CVE-2018-2442 : In SAP BusinessObjects BI (versions 4.0–4.2), viewing a Web Intelligence report from BI Launchpad can reveal session details captured by an HTTP analysis tool, which may be reused in an HTML page while the user session remains valid. This describes a cross‑site request ...

CVE-2018-2444

CVE-2018-2444 affects SAP BusinessObjects Financial Consolidation, versions 10.0 and 10.1. The vulnerability is a Cross-Site Scripting (XSS) flaw caused by insufficient encoding of user-controlled inputs. The CNVD/NVD entries describe a remote-exploitation scenario where an attacker could inject ...

CVE-2018-2447

SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence) 4.2 is affected by CVE-2018-2447. The vulnerability allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects database. Root cause is not fully detailed in the provided sources, but the impact is d...

CVE-2018-2445

CVE-2018-2445 affects SAP BusinessObjects BI Admin Tools in SAP BI Platform (versions 4.1 and 4.2). The vulnerability is a Server-Side Request Forgery (SSRF) allowing an attacker to manipulate the application to send crafted requests on its behalf. CVSS details indicate high impact to confidentia...

CVE-2018-2446

SAP BusinessObjects BI Admin Tools (v4.1, v4.2) contains an information-disclosure issue where an unauthenticated user can read the server name. The root cause and exact impact are described as information disclosure in multiple sources, but the documents do not provide exploit specifics, affecte...

PT-2018-15567

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Financial Consolidation versions 10.0, 10.1 Description The issue is related to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting XSS issue. Recommendations For versions 10.0 and 10.1,...

PT-2018-15566

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence versions 4.0 through 4.2 Description The issue allows user session details to be captured by an HTTP analysis tool and reused in an HTML page while the user session is still valid, potentially leading ...

PT-2018-15568

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence versions 4.1, 4.2 Description The issue allows an unauthenticated user to read sensitive information, such as the server name, leading to an information disclosure. Recommendations For versions 4.1 and...

PT-2018-15569

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Launchpad Web Intelligence version 4.2 Description The issue allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects database. Recommendations For version 4.2, update to ...

PT-2018-3337

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence AdminTools versions 4.1, 4.2 Description: The issue is related to insufficient request validation on the server side, which can be exploited by a remote attacker to perform a Server-Side Request Forge...

CVE-2018-2445: Server-Side Request Forgery (SSRF)

AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting in a Server-Side Request Forgery SSRF vulnerability...

CVE-2018-2444: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Financial Consolidation, versions 10.0, 10.1, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2447: Improper Neutralization of Special Elements used in an SQL Command

SAP BusinessObjects Business Intelligence Launchpad Web Intelligence, version 4.2, allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects database...