CVE-2020-6308-PoC

CVE-2020-6308 SAP POC SAP BusinessObjects Business Intelligence Platform Web Services バージョン 410、420、430 には、認証されていない攻撃者が CMS パラメータとして任意の値を注入し、外部からはアクセスできない内部ネットワークに対してルックアップを実行できるという脆弱性があります。質問がある場合は Twitter でフォローするか DM を送ってください: https://twitter.com/initroott...

sap_bo_launchpad-ssrf-timing_attack

SAP BusinessObjects Launchpad SSRF & タイミング攻撃 PoC このPythonスクリプトは、SAP BusinessObjects Launchpadに対するSSRF（サーバーサイドリクエストフォージェリ）およびタイミング攻撃を実行するための概念実証（PoC）です。セキュリティ研究者や専門家がSAP BusinessObjectsの認証メカニズムを利用して、ターゲットIP上のオープンポートを特定するのに役立つように設計されています。 特徴 SSRF Exploit:...

SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery

SAP BusinessObjects Business Intelligence Platform Web Services 410, 420, and 430 is susceptible to blind server-side request forgery. An attacker can inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not accessible externally. On successful...

CVE-2026-66763

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful...

CVE-2026-66772

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

CVE-2026-58248

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

CVE-2026-66772

CVE-2026-66772 concerns SAP BusinessObjects BI Platform (Admin Tools), where a missing authorization check on certain administrative functionality lets an authenticated non-administrative user bypass restrictions to glean limited information about the affected feature. The impact is described as ...

CVE-2026-66772 Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools)

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

EUVD-2026-55884

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

CVE-2026-66772 Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools)

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

CVE-2026-66763

SAP BusinessObjects BI Platform CENTRAL MANAGEMENT SERVER stores sensitive credentials using a hard-coded cryptographic key. A high-privilege attacker with local server access could enumerate affected user objects and decrypt stored credentials, potentially exfiltrating authentication data and mo...

CVE-2026-66763 Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server)

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful...

EUVD-2026-55880

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful...

CVE-2026-66763 Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server)

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful...

CVE-2026-58248 XML External Entity Injection in SAP BusinessObjects Business Intelligence

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

EUVD-2026-55877

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

CVE-2026-58248

The CVE describes an XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence Platform (Web Intelligence). A low-privileged attacker can upload a specially crafted spreadsheet as a data source; when processed, the component resolves external references and exposes contents...

PT-2026-70044

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Admin Tools affected versions not specified Description Insufficient authorization checks in certain administrative functionality allow an authenticated non-administrative user to bypass...

CVE-2026-66772: Missing Authorization

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

CVE-2026-66763: Use of Hard-coded Cryptographic Key

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful...