CVE-2026-24325

SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting XSS vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.Th...

CVE-2026-24325

SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting XSS vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.Th...

CVE-2026-24325 Cross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Management Console)

SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting XSS vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.Th...

PT-2026-7224

SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting XSS vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.Th...

CVE-2026-24325: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting XSS vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.Th...

EUVD-2010-3956

Malware in sbrugna...

PT-2022-18879

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Enterprise, Central Management Server CMS versions 420, 430 Description The issue is related to the exposure of authentication credentials in Sysmon event logs during an update of the software. This could have a high impact...

CVE-2022-28214: Cleartext Storage of Sensitive Information

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

CVE-2010-0219

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service...

Default credentials

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service...

Code injection

CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain privileges via vectors involving the Program Job Server and the Program Login property...

CVE-2010-0219

CVE-2010-0219 covers Apache Axis2 default credentials that affect dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2 and CA ARCserve D2D r15 among others. The issue arises from a default admin password (axis2), enabling remote attackers to upload a crafted web service and achieve arbitrary co...

CVE-2010-0219: Undefined Security Weakness

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service...

PT-2010-5213

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Enterprise XI version 3.2 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the ServiceClass field to the "Ed...

PT-2010-5212

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Enterprise XI version 3.2 Description The issue allows remote authenticated users to cause a denial of service. This is achieved by requesting a large number of CUIDs via a GenerateCuids SOAPAction to the...

PT-2010-5211

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Enterprise XI version 3.2 Description The issue allows remote attackers to enumerate account names by generating different error messages depending on whether the Login field corresponds to a valid username. This can be don...

PT-2010-5215

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Enterprise XI version 3.2 Description The issue allows remote authenticated users to gain privileges. This is achieved through vectors involving the Program Job Server and the Program Login property. Recommendations For SAP...

PT-2010-5214

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Enterprise XI version 3.2 Description The issue allows remote attackers to trigger TCP connections to arbitrary intranet hosts on any port and obtain potentially sensitive information about open ports. This is related to an...

CVE-2010-3981: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to inject arbitrary web script or HTML via the ServiceClass field to the Edit Service Parameters page...

CVE-2010-3980: Undefined Security Weakness

Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 does not limit the number of CUIDs that may be requested, which allows remote authenticated users to cause a denial of service via a large numCuids value in a GenerateCuids SOAPAction to the dswsbobje/services/biplatform URI...