CVE-2014-8310

The CVE-2014-8310 entry affects SAP BusinessObjects BI Edge 4.0, specifically the CMS CORBA listener. A vulnerability in the OSCAFactory::Session ORB handling allows remote attackers to cause a denial of service (server shutdown). The available data does not specify exploit details beyond the cra...

CVE-2014-8315

CVE-2014-8315 affects polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882. The issue is a timing-based side-channel that allows remote attackers to perform port scanning via a host name and port provided in the cms parameter. Connected records confirm the product/version and the des...

CVE-2014-8310

The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service server shutdown via crafted OSCAFactory::Session ORB message...

SAP Security Note 1908647 - Cross Site Flashing in BusinessObjects Explorer

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: BusinessObjects Explorer Vendor: SAP AG Subject: Cross Site Flashing Risk: High Effect: Remotely exploitable Author: Stefan Horlacher Date: 2014-10-10 SAP Security Note: 1908647 0 Abstract: -------------...

SAP Security Note 1908562 - Port scanning in BusinessObjects Explorer

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: BusinessObjects Explorer Vendor: SAP AG Subject: Potential information disclosure relating to SBOP Explorer Risk: Medium Effect: Remotely exploitable Author: Stefan Horlacher Date: 2014-10-10 SAP Security Note:...

SAP Security Note 1908531 - XXE in BusinessObjects Explorer

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: BusinessObjects Explorer Vendor: SAP AG Subject: Untrusted XML input parsing possible in SBOP Explorer Risk: High Effect: Remotely exploitable Author: Stefan Horlacher Date: 2014-10-10 SAP Security Note: 1908531 0...

[Onapsis Security Advisory 2014-032] SAP BusinessObjects Persistent Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory 2014-032: SAP BusinessObjects Persistent Cross Site Scripting 1. Impact on Business ===================== By exploiting this vulnerability a remote unauthenticated attacker would be able to attack other users of the system...

SAP BusinessObjects Explorer 14.0.5 Cross Site Flashing

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: BusinessObjects Explorer Vendor: SAP AG Subject: Cross Site Flashing Risk: High Effect: Remotely exploitable Author: Stefan Horlacher Date: 2014-10-10 SAP Security Note: 1908647 0 Abstract: -------------...

SAP BusinessObjects Explorer 14.0.5 XXE Injection

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: BusinessObjects Explorer Vendor: SAP AG Subject: Untrusted XML input parsing possible in SBOP Explorer Risk: High Effect: Remotely exploitable Author: Stefan Horlacher Date: 2014-10-10 SAP Security Note: 1908531 0...

SAP BusinessObjects Explorer 14.0.5 Information Disclosure

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: BusinessObjects Explorer Vendor: SAP AG Subject: Potential information disclosure relating to SBOP Explorer Risk: Medium Effect: Remotely exploitable Author: Stefan Horlacher Date: 2014-10-10 SAP Security Note:...

SAP Patches Seven Vulnerabilities in Three Products

SAP pushed out patches to address seven vulnerabilities in three different lines of software it produces. If exploited, the bugs – which weren’t disclosed until yesterday – could expose those running the systems to specialized attacks, information disclosure and in some cases, complete compromise...

Axis2 / SAP BusinessObjects Authenticated Code Execution (via SOAP)

No description provided by source. $Id: axis2deployer.rb 11330 2010-12-14 17:26:44Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of...

SAP BusinessObjects 12 URI Redirection and Cross Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/37972/info SAP BusinessObjects is prone to multiple URI-redirection issues and multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied input. Attackers can exploit these issues to...

Cross site scripting

Cross-site scripting XSS vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3134

Cross-site scripting XSS vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3134

CVE-2014-3134 describes a cross-site scripting (XSS) vulnerability in the InfoView application of SAP BusinessObjects . The flaw allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The available records do not specify the exact vulnerable component version, exp...

Axis2 / SAP BusinessObjects Authenticated Code Execution (via SOAP)

This module logs in to an Axis2 Web Admin Module instance using a specific user/pass and uploads and executes commands via deploying a malicious web service by using SOAP. Module Options msf use exploit/multi/http/axis2/deployer msf undefineddeployer show actions ...actions... msf undefineddeploy...

Metasploit 3.5.1 adds Cisco device exploitation !

Metasploit now enables security professionals to exploit Cisco devices, performs passive reconnaissance through traffic analysis, provides more exploits and evaluates an organization's password security by brute forcing an ever increasing range of services. This latest release adds stealth...

Crystal Reports Viewer 12.0.0.549 Activex Exploit (PrintControl.dll)

Exploit for windows platform in category remote exploits ==================================================================== Crystal Reports Viewer 12.0.0.549 Activex Exploit PrintControl.dll ==================================================================== //payload is windows/exec...

Axis2 / SAP BusinessObjects - (Authenticated) Code Execution (via SOAP) (Metasploit)

$Id: axis2deployer.rb 11330 2010-12-14 17:26:44Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...