The vulnerability of the BI Platform Security component of the Oracle Business Intelligence Enterprise Edition software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the BI Platform Security component of the Oracle Business Intelligence Enterprise Edition is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information using...

CVE-2021-21444

SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack...

Design/Logic Flaw

SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack...

CVE-2021-21444

CVE-2021-21444 affects SAP Business Objects BI Platform versions 410, 420, and 430. The vulnerability stems from the response headers containing multiple X-Frame-Options entries, which may not be uniformly respected by all user agents, potentially nullifying the X-Frame-Options header and enablin...

CVE-2021-21444

SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack...

Oracle Business Intelligence Enterprise Edition Information Disclosure Vulnerability

Oracle Business Intelligence Enterprise Edition OBIEE is a business intelligence BI tool from Oracle Corporation. An information disclosure vulnerability exists in the BI Platform Security component in Oracle Business Intelligence Enterprise Edition 12.2.1.3.0, 12.2.1.4.0. An attacker could explo...

CVE-2021-21447

SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed by User who views the relevant application content, which leads to Stored...

SAP BusinessObjects Business Intelligence 跨站脚本漏洞

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and deploy...

CVE-2020-26831

SAP BusinessObjects BI Platform (Crystal Report) versions 4.1–4.3 contain an XML validation flaw in crystal report generation, allowing an attacker with basic privileges to inject arbitrary XML entities and cause internal file disclosure, internal directory disclosure, SSRF, and DoS. The root cau...

CVE-2020-6308

Summary (CVE-2020-6308) : SAP BusinessObjects Business Intelligence Platform (Web Services) versions 410, 420, and 430 are reported to be vulnerable to a blind Server-Side Request Forgery (SSRF). An unauthenticated attacker can inject arbitrary values into CMS parameters to perform lookups on the...

CVE-2020-6288

SAP Business Objects Business Intelligence Platform Web Intelligence HTML interface allows an attacker with edit document rights to upload any file including script files without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker c...

CVE-2020-6312

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site...

Design/Logic Flaw

SAP Business Objects Business Intelligence Platform Web Intelligence HTML interface allows an attacker with edit document rights to upload any file including script files without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker c...

Cross site scripting

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site...

CVE-2020-6312

The CVE-2020-6312 entry concerns SAP BusinessObjects BI Platform (Web Intelligence HTML interface), affected in version 4.1 and 4.2. A non-administrative user who can edit certain web page properties can influence how the browser processes specific elements, enabling stored Cross-Site Scripting a...

Vulnerabilities fixed in SAP products

Vulnerabilities have been fixed in SAP products. An authentication check was missing in SAP Solution Manager. The vulnerabilities in SAP BusinessObjects Business Intelligence Platform were not explained further. SAP has released updates to fix the vulnerabilities. More information can be found on...

CVE-2020-6294

Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user identity...

CVE-2020-6294

Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user identity...

CVE-2020-6300

CVE-2020-6300 affects SAP Business Objects BI Platform (Central Management Console), versions 4.2 and 4.3. The Root Cause is insufficient encoding of user-controlled inputs for the RecycleBin, enabling a Stored XSS vulnerability. An attacker with administrator rights can use the web app to send m...

CVE-2020-6300

SAP Business Objects Business Intelligence Platform Central Management Console, versions- 4.2, 4.3, allows an attacker with administrator rights can use the web application to send malicious code to a different end user victim, as it does not sufficiently encode user-controlled inputs for...