CVE-2026-0485

SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server CMS to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, renderin...

CVE-2026-0485: Asymmetric Resource Consumption (Amplification)

SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server CMS to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, renderin...

CVE-2026-0490: Missing Authorization

SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, which prevents the legitimate users from accessing the platform. As a result, it has a high impact on the availability but no impact on th...

CVE-2023-40622

SAP BusinessObjects Business Intelligence Platform Promotion Management - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application...

CVE-2023-28765

CVE-2023-28765 concerns SAP BusinessObjects Business Intelligence Platform (Promotion Management) prior to patch versions; specifically 420 and 430. The root cause involves handling of the internal file lcmbiar , enabling a basic-privilege attacker to access and decrypt the file, potentially expo...

CVE-2022-41203: Deserialization of Untrusted Data

In some workflow of SAP BusinessObjects BI Platform Central Management Console and BI LaunchPad, an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which leads to deserialization of untrusted...

CVE-2021-33679: Improper Neutralization of Input During Web Page Generation

The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence...

PT-2021-20257

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects BI Platform version 420 Description: The issue allows an attacker with basic access to the application to inject a malicious script while creating a new module document, file, or folder. When another user visits that page,...

CVE-2020-26831: Undefined Security Weakness

SAP BusinessObjects BI Platform Crystal Report, versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file...

PT-2020-16515

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects BI Platform Crystal Report versions 4.1, 4.2, 4.3 Description The issue arises from insufficient validation of uploaded XML entities during crystal report generation due to missing XML validation. An attacker with basic...

PT-2018-15583

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects BI Platform Servers versions 4.1 through 4.2 Description The issue arises in the Software Development Kit of the SAP BusinessObjects BI Platform Servers. By using a specially crafted URL in a web browser, such as Chrome, th...

CVE-2018-2467: Undefined Security Weakness

In the Software Development Kit in SAP BusinessObjects BI Platform Servers, versions 4.1 and 4.2, using the specially crafted URL in a Web Browser such as Chrome the system returns an error with the path of the used application server...

PT-2015-2432

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects BI Platform version 4.1 BusinessObjects Edge version 4.0 BusinessObjects XI BOXI version 3.1 R3 Description The issue allows remote attackers to cause a denial of service via a crafted GIOP packet, resulting in an...

CVE-2015-7730: Improper Restriction of Operations within the Bounds of a Memory Buffer

SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI BOXI 3.1 R3 allow remote attackers to cause a denial of service out-of-bounds read and listener crash via a crafted GIOP packet, aka SAP Security Note 2001108...