Rittal CMC III Access systems

1. EXECUTIVE SUMMARY CVSS v3 4.8 Vendor: Rittal Equipment: CMC III Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to open control cabinets secured with Rittal locks. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Rittal...

Design/Logic Flaw

A malicious actor can clone access cards used to open control cabinets secured with Rittal CMC III locks...

CVE-2022-40633 Rittal CMC III Improper Access Control

A malicious actor can clone access cards used to open control cabinets secured with Rittal CMC III locks...

CVE-2022-40633

CVE-2022-40633 affects Rittal CMC III control cabinet locks. The root issue is Improper Access Control, enabling a malicious actor to clone access cards to open cabinets. Public sources describe the impact as unauthorized physical access to secured cabinets, with CVSSv3 base metrics (AV: Physical...

Code injection

SAP BusinessObjects Business Intelligence Platform CMC - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that may completely compromise the...

CVE-2023-24530

CVE-2023-24530 affects SAP BusinessObjects BI Platform (CMC) versions 420 and 430. An authenticated admin can upload malicious code that the application can execute over the network, potentially leading to complete compromise of the application and high impact on confidentiality, integrity, and a...

SAP BusinessObjects Business Intelligence Platform XSS (3266006)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is prior to 4.2 SP9 P12, 4.3 SP2 P9 or 4.3 SP3. It is, therefore, affected by a vulnerability. Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business...

SAP BusinessObjects Business Intelligence Platform CMC application cross-site scripting vulnerability

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and deploy...

CVE-2023-0018

Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic user-level privileges can modify/upload crystal reports containing a malicious payload. Once these reports are viewable...

CVE-2023-0018

CVE-2023-0018 concerns SAP BusinessObjects Business Intelligence Platform CMC. The vulnerability arises from improper input sanitization of user-controlled input in versions 420 and 430, enabling an attacker with basic user-level privileges to modify or upload crystal reports containing a malicio...

PT-2023-15950 · Sap · Sap Businessobjects Business Intelligence Platform Cmc Application

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform CMC application versions 420, and 430 Description: The issue arises from improper input sanitization of user-controlled input in the SAP BusinessObjects Business Intelligence Platform CMC...

CVE-2022-39014

Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console CMC - version 430, allows an attacker to access certain unencrypted sensitive parameters which would otherwise be restricted...

CVE-2022-39014

CVE-2022-39014 affects SAP BusinessObjects BI Platform Central Management Console (CMC) 430. The issue is an information-disclosure vulnerability: under certain conditions an attacker could access unencrypted sensitive parameters that should be restricted. The public documents indicate the root c...

PT-2022-24670 · Sap · Sap Businessobjects Business Intelligence Platform Central Management Console

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Central Management Console CMC version 430 Description: The issue allows an attacker to access certain unencrypted sensitive parameters under certain conditions, which would otherwise be...

CVE-2022-35228

SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be achieved only when a legitimate user accesses the application and a local compromise occurs, like sniffing or social engineering. On successfu...

Design/Logic Flaw

SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be achieved only when a legitimate user accesses the application and a local compromise occurs, like sniffing or social engineering. On successfu...

CVE-2022-35228

SAP BusinessObjects Central Management Console (CMC) is affected by CVE-2022-35228. The issue allows an unauthenticated attacker to retrieve token information over the network under conditions where a legitimate user accesses the application and a local compromise (e.g., sniffing or social engine...

MAL-2022-1949 Malicious code in cmc-api-workshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d5c712b026b6d69e647566d7f756d30988e767cce654898f838a52c49249b69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cmc-api-workshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d5c712b026b6d69e647566d7f756d30988e767cce654898f838a52c49249b69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross site scripting

BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. Exploit is possible only when the bttoken in victim’s session is active...