CVE-2023-22105

Vulnerability in the BI Publisher product of Oracle Analytics component: Web Server. Supported versions that are affected are 6.4.0.0.0 and 7.0.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise BI Publisher. Successful attacks requir...

Code injection

Vulnerability in the BI Publisher product of Oracle Analytics component: Web Server. Supported versions that are affected are 6.4.0.0.0 and 7.0.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise BI Publisher. Successful attacks requir...

CVE-2023-22105

Oracle BI Publisher in Oracle Analytics (Web Server component) is affected by CVE-2023-22105 for versions 6.4.0.0.0 and 7.0.0.0.0. The issue allows a low-privileged, network-access attacker (via HTTP) to compromise BI Publisher, with required user interaction, potentially leading to unauthorized ...

PT-2023-6382 · Oracle · Oracle Analytics Bi Publisher

Name of the Vulnerable Software and Affected Versions: Oracle Analytics BI Publisher versions 6.4.0.0.0 through 7.0.0.0.0 Description: The issue is related to insufficient input validation in the Web Server component of Oracle BI Publisher. This allows a low-privileged attacker with network acces...

Oracle BI Publisher Security Vulnerability

Oracle BI Publisher is a reporting solution from Oracle that makes it easier and faster to create, manage and deliver all reports and documents than traditional reporting tools. A security vulnerability exists in Oracle Analytics' BI Publisher versions 6.4.0.0.0 and 7.0.0.0.0, which stems from a...

Electrolink FM/DAB/TV Transmitter Vertical Privilege Escalation

Summary Since 1990 Electrolink has been dealing with design and manufacturing of advanced technologies for radio and television broadcasting. The most comprehensive products range includes: FM Transmitters, DAB Transmitters, TV Transmitters for analogue and digital multistandard operation, Bandpa...

CVE-2023-40622

SAP BusinessObjects Business Intelligence Platform Promotion Management - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application...

CVE-2023-40622

CVE-2023-40622 affects SAP BusinessObjects Business Intelligence Platform (Promotion Management) versions 420 and 430. The vulnerability allows an authenticated attacker to view restricted information, potentially leading to a full compromise of the application with high impacts to confidentialit...

CVE-2023-42472 Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image file, an authenticated attacker could...

CVE-2023-37489 Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System)

Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform Version Management System - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low impact on confidentiality and no impact on the application's availability or...

CVE-2023-39440

In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user credentials. For a successful attack, the attacker needs to...

Design/Logic Flaw

In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user credentials. For a successful attack, the attacker needs to...

CVE-2023-39440 Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform

In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user credentials. For a successful attack, the attacker needs to...

Vulnerabilities fixed in Oracle Analytics

Vulnerabilities have been fixed in Oracle Analytics products. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can result in the following categories of damage: Denial-of-Service DoS. Manipulation of data Remote code execution Administrator/Root rights Remo...

CVE-2023-36917

SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impa...

Directory traversal

An attacker with non-administrative authorizations in SAP NetWeaver BI CONT ADD ON - versions 707, 737, 747, 757, can exploit a directory traversal flaw to over-write system files. Data from confidential files cannot be read but potentially some OS files can be over-written leading to system...

CVE-2023-36917

SAP BusinessObjects Business Intelligence Platform versions 420 and 430 are affected by an authentication bypass where an attacker who hijacks a user session can brute-force the victim’s old password due to an unrestricted rate limit on the password-change function. The attack, as described in th...

CVE-2023-35154

CVE-2023-35154 is a Knowage-Server vulnerability: from Knowage 6.0.0 up to 8.1.7, an attacker can register and activate an account without clicking the email link, effectively gaining access as a normal user. Root cause is an account‑validation bypass in the authentication/registration flow. The ...

SAP BusinessObjects Business Intelligence Platform Information Disclosure (3038911)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by a information disclosure vulnerability. Under certain conditions, SAP BusinessObjects Business Intelligence Platform Central Management Service - versions 420, 430, allows an...

SAP BusinessObjects Business Intelligence Platform Information Disclosure

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by a information disclosure vulnerability. Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console CMC - version 430, allows an attack...