PT-2019-9096

Name of the Vulnerable Software and Affected Versions BPC SmartVista version 2 Description The issue concerns a session fixation problem via the JSESSIONID parameter. Recommendations For version 2, consider restricting access to the JSESSIONID parameter to minimize the risk of exploitation...

CVE-2018-15206: Cross-Site Request Forgery (CSRF)

BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf...

CVE-2018-15208: Session Fixation

BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter...

CVE-2018-15207: Improper Privilege Management

BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pages/finadmin/currconvrate/currconvrate.jsf functionality that should be only accessible to an admin...

PT-2019-9095

Name of the Vulnerable Software and Affected Versions BPC SmartVista 2 Description The issue is related to improper access control in the SVFE module. A normal user can access the "SVFE2/pages/finadmin/currconvrate/currconvrate.jsf" functionality, which should only be accessible to an admin...

PT-2019-9094

Name of the Vulnerable Software and Affected Versions BPC SmartVista 2 Description The issue is related to a CSRF problem. It affects the /SVFE2/pages/admpages/roles/createrole.jsf API endpoint. Recommendations For BPC SmartVista 2, consider implementing proper CSRF protection mechanisms to preve...

bpc-esc.com XSS vulnerability

Open Bug Bounty ID: OBB-674425 Description| Value ---|--- Affected Website:| bpc-esc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Flexit Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Xxe

An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP...

CVE-2017-16349

An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP...

CVE-2017-16349

CVE-2017-16349 affects SAP BPC, with an XML External Entity (XXE) injection in the reporting functionality. A crafted XML request can reference an XXE to disclose information or cause denial of service, and authenticated HTTP requests can trigger it. Public reports (e.g., Talos) describe the vuln...

CVE-2017-16349

An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP...

CVE-2017-16349: Improper Restriction of XML External Entity Reference

An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP...

bpc-esc.com XSS vulnerability

Open Bug Bounty ID: OBB-626515 Description| Value ---|--- Affected Website:| bpc-esc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Flexit Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

SAP BPC Web Application Information Disclosure Vulnerability

Talos Vulnerability Report SAP SAP BPC Web Application Information Disclosure Vulnerability April 19, 2018 CVE Number CVE-2017-16349 Summary An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external...

SAP BPC Web Application Information Disclosure Vulnerability

Summary An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HT...

Vendor BPC Silent on Patching SQL Injection in SmartVista Ecommerce Software

A popular ecommerce platform sold in 60 countries suffers from a SQL injection vulnerability privately disclosed in April that has yet to be patched by the vendor. BPC Banking Technologies of Switzerland has not acknowledged the vulnerability in its SmartVista suite of ecommerce and financial...