CVE-2023-42478 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when opened by any other user could lead to high impact on integrity of the application...

CVE-2023-42476 Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence

SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. Successful exploitation can lead to exposure of the data that th...

VulnCheck KEV: CVE-2010-0219

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service...

The vulnerability of the SAP BusinessObjects Business Intelligence platform, related to insufficient protection of operational data, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the SAP BusinessObjects Business Intelligence platform is related to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2023-42474

SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information...

CVE-2023-42474

SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information...

Design/Logic Flaw

SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information...

CVE-2023-42474 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence

SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information...

CVE-2023-42474

Affected product and vulnerability. SAP BusinessObjects Web Intelligence 420 is affected by a cross-site scripting (XSS) vulnerability in a URL parameter, arising from insufficient filtering/escaping of user-supplied data. This could allow an attacker to exfiltrate or view sensitive information b...

CVE-2023-42474 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence

SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information...

PT-2023-5867 · Sap · Sap Businessobjects Business Intelligence

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Web Intelligence version 420 Description: The issue is related to the failure to protect the web page structure, which could allow a remote attacker to gain unauthorized access to protected information by opening a special...

SAP BusinessObjects Business Intelligence Platform Authentication Bypass (3320702)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by an authentication bypass vulnerability. SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to ...

CVE-2023-40623

SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker can delete all the operating system files causing a limited...

CVE-2023-40622

SAP BusinessObjects Business Intelligence Platform Promotion Management - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application...

CVE-2023-40622

SAP BusinessObjects Business Intelligence Platform Promotion Management - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application...

Directory traversal

SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker can delete all the operating system files causing a limited...

CVE-2023-42472

Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image file, an authenticated attacker could...

CVE-2023-42472

Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image file, an authenticated attacker could...

CVE-2023-37489

Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform Version Management System - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low impact on confidentiality and no impact on the application's availability or...

CVE-2023-37489

Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform Version Management System - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low impact on confidentiality and no impact on the application's availability or...