CVE-2010-0219: Undefined Security Weakness

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service...

CVE-2010-3983: Undefined Security Weakness

CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain privileges via vectors involving the Program Job Server and the Program Login property...

Axis2 -- Cross-site scripting (XSS) vulnerability

Apache Axis2 reports: Apache Axis2 1.7.3 is a security release that contains a fix for CVE-2010-3981. That security vulnerability affects the admin console that is part of the Axis2 Web application and was originally reported for SAP BusinessObjects which includes a version of Axis2. That report...

CVE-2010-3982: Exposure of Sensitive Information to an Unauthorized Actor

SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to trigger TCP connections to arbitrary intranet hosts on any port, and obtain potentially sensitive information about open ports, via the apstoken parameter to the CrystalReports/viewrpt.cwr URI, related to an "internal port scanning"...

CVE-2010-3979: Exposure of Sensitive Information to an Unauthorized Actor

Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 generates different error messages depending on whether the Login field corresponds to a valid username, which allows remote attackers to enumerate account names via a login SOAPAction to the dswsbobje/services/session URI...

CVE-2010-3981: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to inject arbitrary web script or HTML via the ServiceClass field to the Edit Service Parameters page...

CVE-2010-3980: Undefined Security Weakness

Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 does not limit the number of CUIDs that may be requested, which allows remote authenticated users to cause a denial of service via a large numCuids value in a GenerateCuids SOAPAction to the dswsbobje/services/biplatform URI...

Rapid7 Security Advisory 37

R7-0037: SAP BusinessObjects Axis2 Default Admin Password October 13th, 2010 Description: The SAP BusinessObjects product contains a module dswsbobje.war which deploys Axis2 with an administrator account which is configured with a static password. As a result, anyone with access to the Axis2 port...

SAP BusinessObjects Axis2 Default Admin Password

Overview The Axis2 component of SAP BusinessObjects contains a default administrator account and password. Description The SAP BusinessObjects product contains a module dswsbobje.war which deploys Axis2 with an administrator account which is configured with a static password. As a result, anyone...

SAP BusinessObjects viewError.jsp 'error' Parameter XSS

The version of SAP BusinessObjects installed on the remote web server has a cross-site scripting vulnerability. Input passed to the 'error' parameter of '/PerformanceManagement/jsp/viewError.jsp' is not properly sanitized. A remote attacker could exploit this by tricking a user into requesting a...

SAP BusinessObjects Detection

The remote host is running SAP BusinessObjects, a business intelligence system written in Java. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid44341; scriptversion"1.6"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"SAP BusinessObjects Detection";...

PR09-02 Multiple Cross-Site Scripting (XSS) / Cross Domain redirects and Server path information disclosure on SAP BusinessObjects version 12

Hi, We have found that SAP BusinessObjects version 12 is vulnerable to Multiple Cross-Site Scripting XSS, Cross Domain redirects and Server path information disclosure with the following consecuences: -An attacker may be able to cause execution of malicious scripting code in the browser of a vict...

SAP BusinessObjects crossite scripting

No description provided...

SAP BusinessObjects 12 - URI redirection Cross-Site Scripting

SAP BusinessObjects 12 - URI redirection Cross-Site Scripting source: https://www.securityfocus.com/bid/37972/info SAP BusinessObjects is prone to multiple URI-redirection issues and multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied input. Attackers can...

SAP BusinessObjects 12 - URI redirection / Cross-Site Scripting

source: https://www.securityfocus.com/bid/37972/info SAP BusinessObjects is prone to multiple URI-redirection issues and multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied input. Attackers can exploit these issues to execute arbitrary script or HTML code,...

Crystal Reports Cross Site Scripting

SAP BusinessObjects Crystal Reports viewreport.asp Multiple Parameter XSS - Description Cross-site scripting; vbscript rather than javascript. Subsequent page will contain pop up reading "fsckcissp". ID, PROMPTEX-SESSIONID, PROMPTEX-TODATE, PROMPTEX-FROMDATE, PROMPTEX-YEARQTR1, PROMPTEX-YEARQTR2,...

CVE-2008-1894

Cross-site scripting XSS vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter...

CVE-2008-1894

Cross-site scripting XSS vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter...

CVE-2008-1894

CVE-2008-1894 affects BusinessObjects InfoView XI R2 (SP1, SP2, SP3) Java version before FixPack 3.5. The vulnerability is an XSS in desktoplaunch/InfoView/logon/logon.object via the cms parameter, allowing remote attackers to inject arbitrary web script/HTML. Evidence from CVE records and NVD co...