PT-2020-19052

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform CMC and BI Launchpad version 4.2 Description The issue is related to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting issue. Recommendations For SAP Busine...

CVE-2020-6257: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform CMC and BI Launchpad 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability...

CVE-2020-6195

SAP Business Objects Business Intelligence Platform CMC, version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to...

CVE-2020-6195

The CVE-2020-6195 entry applies to SAP Business Objects Business Intelligence Platform (CMC) versions 4.1 and 4.2, where the response can contain a cleartext password. The underlying issue is information disclosure via exposed credentials, which, if exploited via social engineering to obtain a pa...

PT-2020-18997

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform CMC versions 4.1, 4.2 Description The issue involves the disclosure of cleartext passwords in responses, potentially leading to information disclosure. This could be exploited through social...

CVE-2020-6195: Cleartext Transmission of Sensitive Information

SAP Business Objects Business Intelligence Platform CMC, version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to...

Information disclosure

Certain settings pages in SAP Business Objects Business Intelligence Platform CMC, version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure...

CVE-2020-6189

Certain settings pages in SAP Business Objects Business Intelligence Platform CMC, version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure...

CVE-2020-6189

Certain settings pages in SAP Business Objects Business Intelligence Platform CMC, version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure...

CVE-2020-6189

CVE-2020-6189 affects SAP Business Objects Business Intelligence Platform (CMC) 4.2. The issue arises from certain settings pages generating error messages that can disclose enterprise private-network information that should be restricted, leading to information disclosure. The available document...

PT-2020-18992

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform CMC version 4.2 Description The issue concerns certain settings pages in the SAP Business Objects Business Intelligence Platform CMC that generate error messages. These error messages can...

CVE-2020-6189: Generation of Error Message Containing Sensitive Information

Certain settings pages in SAP Business Objects Business Intelligence Platform CMC, version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure...

Stored XSS in field name data model

Summary An attacker with admin access to the appliance can inject malicious code that will later be executed by another legitimate users. This allows an attacker to perform unauthorized actions on behalf of legitimate users. JavaScript injection was possible using the field name when adding new...

Information disclosure

IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CMC UI headers. IBM X-Force ID: 154284...

CVE-2018-1991

IBM API Connect 5.0.0.0–5.0.8.6 is affected by an information-disclosure vulnerability (CVE-2018-1991) that could reveal sensitive information about the underlying software stack via CMC UI headers. The root cause is a disclosure in requests/responses that exposes internal details. Affected produ...

PT-2019-9943

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 5.0.0.0 through 5.0.8.6 Description The issue allows sensitive information to be returned, potentially revealing critical details about the underlying software stack through CMC UI headers. Recommendations For versions...

CVE-2018-1991: Exposure of Sensitive Information to an Unauthorized Actor

IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CMC UI headers. IBM X-Force ID: 154284...

CVE-2019-0268

SAP BusinessObjects Business Intelligence Platform CMC Module, versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source...

CVE-2019-0268: XML Injection (aka Blind XPath Injection)

SAP BusinessObjects Business Intelligence Platform CMC Module, versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source...

PT-2019-5602

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform CMC Module versions 4.10 through 4.30 Description The issue is related to insufficient validation of an XML document accepted from an untrusted source. This could potentially allow a remote...