CVE-2010-3979: Exposure of Sensitive Information to an Unauthorized Actor

Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 generates different error messages depending on whether the Login field corresponds to a valid username, which allows remote attackers to enumerate account names via a login SOAPAction to the dswsbobje/services/session URI...

CVE-2010-3980: Undefined Security Weakness

Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 does not limit the number of CUIDs that may be requested, which allows remote authenticated users to cause a denial of service via a large numCuids value in a GenerateCuids SOAPAction to the dswsbobje/services/biplatform URI...

Rapid7 Security Advisory 37

R7-0037: SAP BusinessObjects Axis2 Default Admin Password October 13th, 2010 Description: The SAP BusinessObjects product contains a module dswsbobje.war which deploys Axis2 with an administrator account which is configured with a static password. As a result, anyone with access to the Axis2 port...

SAP BusinessObjects Axis2 Default Admin Password

Overview The Axis2 component of SAP BusinessObjects contains a default administrator account and password. Description The SAP BusinessObjects product contains a module dswsbobje.war which deploys Axis2 with an administrator account which is configured with a static password. As a result, anyone...

SAP BusinessObjects viewError.jsp 'error' Parameter XSS

The version of SAP BusinessObjects installed on the remote web server has a cross-site scripting vulnerability. Input passed to the 'error' parameter of '/PerformanceManagement/jsp/viewError.jsp' is not properly sanitized. A remote attacker could exploit this by tricking a user into requesting a...

SAP BusinessObjects Detection

The remote host is running SAP BusinessObjects, a business intelligence system written in Java. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid44341; scriptversion"1.6"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"SAP BusinessObjects Detection";...

PR09-02 Multiple Cross-Site Scripting (XSS) / Cross Domain redirects and Server path information disclosure on SAP BusinessObjects version 12

Hi, We have found that SAP BusinessObjects version 12 is vulnerable to Multiple Cross-Site Scripting XSS, Cross Domain redirects and Server path information disclosure with the following consecuences: -An attacker may be able to cause execution of malicious scripting code in the browser of a vict...

SAP BusinessObjects crossite scripting

No description provided...

SAP BusinessObjects 12 - URI redirection Cross-Site Scripting

SAP BusinessObjects 12 - URI redirection Cross-Site Scripting source: https://www.securityfocus.com/bid/37972/info SAP BusinessObjects is prone to multiple URI-redirection issues and multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied input. Attackers can...

SAP BusinessObjects 12 - URI redirection / Cross-Site Scripting

source: https://www.securityfocus.com/bid/37972/info SAP BusinessObjects is prone to multiple URI-redirection issues and multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied input. Attackers can exploit these issues to execute arbitrary script or HTML code,...

Crystal Reports Cross Site Scripting

SAP BusinessObjects Crystal Reports viewreport.asp Multiple Parameter XSS - Description Cross-site scripting; vbscript rather than javascript. Subsequent page will contain pop up reading "fsckcissp". ID, PROMPTEX-SESSIONID, PROMPTEX-TODATE, PROMPTEX-FROMDATE, PROMPTEX-YEARQTR1, PROMPTEX-YEARQTR2,...

CVE-2007-6254

Stack-based buffer overflow in the SAP Business Objects BusinessObjects RptViewerAX ActiveX control in RptViewerAX.dll in Business Objects 6.5 before CHF74 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2007-6254

Stack-based buffer overflow in the SAP Business Objects BusinessObjects RptViewerAX ActiveX control in RptViewerAX.dll in Business Objects 6.5 before CHF74 allows remote attackers to execute arbitrary code via unspecified vectors...