PT-2021-20273

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Crystal Report versions 420, 430 Description: The issue arises from insufficient encoding of user-controlled inputs, allowing an authorized attacker to exploit a XSS vulnerability. This can...

CVE-2021-33697: Use of Web Link to Untrusted Target with window.opener Access

Under certain conditions, SAP BusinessObjects Business Intelligence Platform SAPUI5, versions - 420, 430, can allow an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities...

CVE-2021-33696: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Business Intelligence Platform Crystal Report, versions - 420, 430, does not sufficiently encode user controlled inputs and therefore an authorized attacker can exploit a XSS vulnerability, leading to non-permanently deface or modify displayed content from a Web site...

CVE-2021-33679

The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence...

Design/Logic Flaw

The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence...

CVE-2021-33679

The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence...

CVE-2021-33679

The CVE-2021-33679 entry affects SAP BusinessObjects BI Platform 420. An attacker with basic access can inject a stored script when creating a new module document, file, or folder; when other users visit the page, the script executes in their session, compromising confidentiality and integrity. N...

PT-2021-20257

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects BI Platform version 420 Description: The issue allows an attacker with basic access to the application to inject a malicious script while creating a new module document, file, or folder. When another user visits that page,...

CVE-2021-33679: Improper Neutralization of Input During Web Page Generation

The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence...

SAP BusinessObjects BI Platform 420 跨站脚本漏洞

SAP BusinessObjects BI Platform is a centralized suite for data reporting, visualization, and sharing from SAP, Germany. A security vulnerability in SAP BusinessObjects BI Platform version 420 allows an attacker with basic access to the application to inject a malicious script when creating a new...

Exploit for Server-Side Request Forgery in Sap Businessobjects_Business_Intelligence_Platform

CVE-2020-6308 Exploit script for SAP Business Objects SSRF Th...

CVE-2014-9320

SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SIPLATFORMSEARCHSERVERLOGONTOKEN token and consequently gain SYSTEM privileges via vectors involving CORBA calls, aka SAP Note 2039905...

CVE-2015-2073

The File RepositoRy Server FRS CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to read arbitrary files via a full pathname, aka SAP Note 2018682...

CVE-2015-2074

The File Repository Server FRS CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to write to arbitrary files via a full pathname, aka SAP Note 2018681...

Code injection

SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SIPLATFORMSEARCHSERVERLOGONTOKEN token and consequently gain SYSTEM privileges via vectors involving CORBA calls, aka SAP Note 2039905...

Design/Logic Flaw

The File RepositoRy Server FRS CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to read arbitrary files via a full pathname, aka SAP Note 2018682...

CVE-2014-9320

SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SIPLATFORMSEARCHSERVERLOGONTOKEN token and consequently gain SYSTEM privileges via vectors involving CORBA calls, aka SAP Note 2039905...

CVE-2014-9320

CVE-2014-9320 affects SAP BusinessObjects Edge 4.1. An attacker can obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN via CORBA, enabling privilege escalation to SYSTEM. The issue originates from improper access control in CORBA calls, potentially exploitable by remote users (possibly without auth...

CVE-2015-2073

The File RepositoRy Server FRS CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to read arbitrary files via a full pathname, aka SAP Note 2018682...

PT-2021-8388

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Edge version 4.0 Description The issue allows remote attackers to write to arbitrary files via a full pathname. This is related to the File Repository Server FRS CORBA listener. Recommendations For SAP BusinessObjects Edge...