CVE-2022-35169

SAP BusinessObjects Business Intelligence Platform (LCM) versions 420 and 430 are affected by CVE-2022-35169, where an administrator can read and decrypt the LCMBIAR file password under certain conditions. This could lead to password modification or importing the file into another system, with hi...

CVE-2022-31591

SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service...

CVE-2022-31591

CVE-2022-31591 affects SAP BusinessObjects BW Publisher Service versions 420 and 430. The root cause is a search path containing an unquoted element, enabling a local attacker to gain elevated privileges by placing an executable in the service’s path. The Red Hat, CNVD, and CVE records corroborat...

CVE-2022-29619

Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of objects it doesn't own and which would otherwise be restricted...

CVE-2022-29619

SAP BusinessObjects Business Intelligence Platform (4.x; v4.2.0 and v4.3.0) contains an authorization flaw where an Administrator can view, edit or modify rights of objects it does not own and that would normally be restricted. Root cause: incorrect access control for object rights, enabling priv...

SAP BusinessObjects Business Intelligence Platform 信息泄露漏洞

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP Germany. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly...

CVE-2022-35228: Cross-Site Request Forgery (CSRF)

SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be achieved only when a legitimate user accesses the application and a local compromise occurs, like sniffing or social engineering. On successfu...

CVE-2022-35169: Exposure of Sensitive Information to an Unauthorized Actor

SAP BusinessObjects Business Intelligence Platform LCM - versions 420, 430, allows an attacker with an admin privilege to read and decrypt LCMBIAR file's password under certain conditions, enabling the attacker to modify the password or import the file into another system causing high impact on...

CVE-2022-31591: Unquoted Search Path or Element

SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service...

CVE-2022-29619: Incorrect Authorization

Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of objects it doesn't own and which would otherwise be restricted...

PT-2022-4934

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence affected versions not specified Description The issue is related to a component of the SAP BusinessObjects Business Intelligence platform, specifically the Central Management Console CMC, and involves ...

PT-2022-4930

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform LCM versions 420, 430 Description The issue allows an attacker with admin privileges to read and decrypt the LCMBIAR file's password under certain conditions. This enables the attacker to modi...

CVE-2020-6220

BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. Exploit is possible only when the bttoken in victim’s session is active...

PT-2022-4736

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects BW Publisher Service versions 420, 430 Description The issue is related to the absence of quotes in writing elements or search paths, which can be exploited by a local attacker to gain elevated privileges by inserting an...

CVE-2022-28214

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

CVE-2022-28214

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

CVE-2022-28214

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

Authentication flaw

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

CVE-2022-28214

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

CVE-2022-28214

CVE-2022-28214 affects SAP BusinessObjects Enterprise CMS (versions 420 and 430). During an update, authentication credentials are exposed in Sysmon event logs, causing Information Disclosure with high impact to Confidentiality, Integrity, and Availability. The NVD/NVD-derived metrics list CVSSv3...