CVE-2020-6368

CVE-2020-6368 affects SAP Business Planning and Consolidation (versions 750, 751, 752, 753, 754, 755, 810, 100, 200). The vulnerability allows an attacker to modify displayed application content without authorization and potentially obtain authentication information from other legitimate users, l...

CVE-2020-6368

SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users, leading to...

CVE-2018-15206

BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf...

CVE-2018-15208

BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter...

Session fixation

BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter...

Improper access control

BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pages/finadmin/currconvrate/currconvrate.jsf functionality that should be only accessible to an admin...

CVE-2018-15208

The CVE-2018-15208 entry concerns BPC SmartVista 2, where a Session Fixation vulnerability exists via the JSESSIONID parameter. According to the NVD record, the vulnerability has a CVSS v3 base score of 7.5 (HIGH) with NETWORK attack vector, HIGH attack complexity, no privileges required, user in...

CVE-2018-15207

BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pages/finadmin/currconvrate/currconvrate.jsf functionality that should be only accessible to an admin...

CVE-2018-15207

The CVE-2018-15207 entry concerns BPC SmartVista 2, specifically the SVFE module. Affected component: SVFE2/pages/finadmin/currconvrate/currconvrate.jsf. Root cause: Improper access control that allows a normal user to access functionality intended for admins. Impact stated in CVSS metrics is hig...

CVE-2018-15206

CVE-2018-15206 affects BPC SmartVista 2 with a CSRF flaw exposed at SVFE2/pages/admpages/roles/createrole.jsf. CVSSv3 indicates HIGH impact (8.8) with network attack, low complexity, no privileges, but requires user interaction; confidentiality, integrity, and availability are rated HIGH. No reme...

bpc-esc.com XSS vulnerability

Open Bug Bounty ID: OBB-674425 Description| Value ---|--- Affected Website:| bpc-esc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Flexit Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Xxe

An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP...

CVE-2017-16349

An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP...

CVE-2017-16349

CVE-2017-16349 affects SAP BPC, with an XML External Entity (XXE) injection in the reporting functionality. A crafted XML request can reference an XXE to disclose information or cause denial of service, and authenticated HTTP requests can trigger it. Public reports (e.g., Talos) describe the vuln...

CVE-2017-16349

An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP...

bpc-esc.com XSS vulnerability

Open Bug Bounty ID: OBB-626515 Description| Value ---|--- Affected Website:| bpc-esc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Flexit Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

SAP BPC Web Application Information Disclosure Vulnerability

Talos Vulnerability Report SAP SAP BPC Web Application Information Disclosure Vulnerability April 19, 2018 CVE Number CVE-2017-16349 Summary An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external...

SAP BPC Web Application Information Disclosure Vulnerability

Summary An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HT...

Vendor BPC Silent on Patching SQL Injection in SmartVista Ecommerce Software

A popular ecommerce platform sold in 60 countries suffers from a SQL injection vulnerability privately disclosed in April that has yet to be patched by the vendor. BPC Banking Technologies of Switzerland has not acknowledged the vulnerability in its SmartVista suite of ecommerce and financial...