SAP BusinessObjects Mobile - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application SAP BusinessObjects Mobile published at the 'play' market has multiple vulnerabilities...

Out-of-bounds

SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI BOXI 3.1 R3 allow remote attackers to cause a denial of service out-of-bounds read and listener crash via a crafted GIOP packet, aka SAP Security Note 2001108...

CVE-2015-7730

CVE-2015-7730 affects SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3. A crafted GIOP packet can trigger an out-of-bounds read and listener crash, enabling remote denial of service. The entry documents this as SAP Security Note 2001108. Exploita...

CVE-2015-7730

SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI BOXI 3.1 R3 allow remote attackers to cause a denial of service out-of-bounds read and listener crash via a crafted GIOP packet, aka SAP Security Note 2001108...

CVE-2015-2076

The Auditing service in SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information by reading an audit event, aka SAP Note 2011395...

CVE-2015-2075

SAP BusinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396...

CVE-2015-2076

The Auditing service in SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information by reading an audit event, aka SAP Note 2011395...

Design/Logic Flaw

SAP BusinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396...

CVE-2015-2075

SAP BusinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396...

Design/Logic Flaw

The Auditing service in SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information by reading an audit event, aka SAP Note 2011395...

CVE-2015-2075

SAP BusinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396...

CVE-2015-2076

The Auditing service in SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information by reading an audit event, aka SAP Note 2011395...

CVE-2015-2075

SAP BusinessObjects Edge 4.0 is vulnerable to an unauthenticated remote attack that can delete audit events from the auditee queue via the clearData CORBA operation. The root cause is improper authorization (CWE-285) in the CORBA interface, allowing an attacker to instruct the remote auditee to c...

CVE-2015-2076

The CVE-2015-2076 vulnerability affects SAP BusinessObjects Edge 4.0, where an unauthenticated remote attacker could read auditing information via the Auditing service. The Onapsis advisory and SAP notes identify an unauthorized access risk exposing audit events (e.g., report names, universe quer...

SAP BussinessObjects Edge Unauthorized Access Vulnerability (CNVD-2015-01234)

SAP BusinessObjects is a business intelligence software and enterprise performance solution. An unauthorized access vulnerability exists in SAP BussinessObjects Edge, which can be exploited by attackers to gain unauthorized access and obtain sensitive information...

SAP BussinessObjects Edge Unauthorized Access Vulnerability (CNVD-2015-01235)

SAP BusinessObjects is a business intelligence software and enterprise performance solution. An unauthorized access vulnerability exists in SAP BussinessObjects Edge, which can be exploited by attackers to gain unauthorized access and obtain sensitive information...

SAP BussinessObjects Edge Security Bypass Vulnerability

SAP BusinessObjects is a business intelligence software and enterprise performance solution. A security bypass vulnerability exists in SAP BussinessObjects Edge, which can be exploited by an attacker to perform unauthorized operations bypassing security restrictions...

CVE-2014-9387

SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SIPLATFORMSEARCHSERVERLOGONTOKEN token and gain privileges via a crafted CORBA call, aka SAP Note 2039905...

Code injection

SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SIPLATFORMSEARCHSERVERLOGONTOKEN token and gain privileges via a crafted CORBA call, aka SAP Note 2039905...

CVE-2014-9387

SAP BusinessObjects Edge 4.1 is affected by CVE-2014-9387 through a crafted CORBA call that allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN and escalate privileges. The underlying cause is exposure of a login token via CORBA, enabling complete confidentiality, integrit...