CVE-2014-9387

SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SIPLATFORMSEARCHSERVERLOGONTOKEN token and gain privileges via a crafted CORBA call, aka SAP Note 2039905...

CVE-2014-8315

polestarxml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and port in the cms parameter...

CVE-2014-8316

XML External Entity XXE vulnerability in polestarxml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate request...

CVE-2014-8308

Cross-site scripting XSS vulnerability in the Send to Inbox functionality in SAP BusinessObjects BI EDGE 4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8310

The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service server shutdown via crafted OSCAFactory::Session ORB message...

CVE-2014-8311

SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener...

CVE-2014-8309

SAP BusinessObjects 4.0 and BusinessObjects XI BOXI R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the...

Code injection

polestarxml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and port in the cms parameter...

Xxe

XML External Entity XXE vulnerability in polestarxml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate request...

Design/Logic Flaw

SAP BusinessObjects 4.0 and BusinessObjects XI BOXI R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the...

Design/Logic Flaw

SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener...

CVE-2014-8308

CVE-2014-8308 is an XSS vulnerability in SAP BusinessObjects BI EDGE 4.0’s Send to Inbox function. CVSS2 base score 4.3 (MEDIUM); attack vector NETWORK, attack complexity MEDIUM, no authentication, confidentiality impact NONE, integrity impact PARTIAL, availability impact NONE. Exploitation detai...

CVE-2014-8311

CVE-2014-8311 affects SAP BusinessObjects Edge 4.0. Remote attackers can obtain sensitive information via an InfoStore query to a CORBA listener, causing information disclosure. The provided sources do not specify affected subversions or a fixed patch in this context. Exploitation details are not...

CVE-2014-8309

SAP BusinessObjects 4.0 and BusinessObjects XI BOXI R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the...

CVE-2014-8316

XML External Entity XXE vulnerability in polestarxml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate request...

CVE-2014-8309

CVE-2014-8309 affects SAP BusinessObjects 4.0 and BOXI R2/3.1. The issue stems from error messages shown after failed logon attempts, which vary in delay based on whether the user exists, enabling remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the Sessi...

CVE-2014-8316

CVE-2014-8316 is an XML External Entity (XXE) vulnerability in SAP BusinessObjects Explorer 14.0.5 build 882, affecting polestar_xml.jsp. The issue enables remote attackers to read arbitrary files through the xmlParameter parameter in an explorationSpaceUpdate request, implying potential partial ...

CVE-2014-8315

polestarxml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and port in the cms parameter...

CVE-2014-8311

SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener...

CVE-2014-8308

Cross-site scripting XSS vulnerability in the Send to Inbox functionality in SAP BusinessObjects BI EDGE 4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...