CVE-2020-26831

SAP BusinessObjects BI Platform Crystal Report, versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file...

CVE-2020-26831

SAP BusinessObjects BI Platform (Crystal Report) versions 4.1–4.3 contain an XML validation flaw in crystal report generation, allowing an attacker with basic privileges to inject arbitrary XML entities and cause internal file disclosure, internal directory disclosure, SSRF, and DoS. The root cau...

CVE-2020-26831: Undefined Security Weakness

SAP BusinessObjects BI Platform Crystal Report, versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file...

PT-2020-16515

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects BI Platform Crystal Report versions 4.1, 4.2, 4.3 Description The issue arises from insufficient validation of uploaded XML entities during crystal report generation due to missing XML validation. An attacker with basic...

SAP BusinessObjects BI Platform 产品安全漏洞

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product features report generation, analytics and data visualization. An XML external entity injection vulnerability exists in SAP BusinessObjects...

SAP BusinessObjects Business Intelligence Platform Information Disclosure Vulnerability (CNVD-2020-62466)

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. An information disclosure vulnerability exists in SAP Business Object...

SAP BusinessObjects Business Intelligence Platform Cross-Site Request Forgery Vulnerability

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product has report generation, analysis, data visualization and other functions. A cross-site request forgery vulnerability exists in SAP...

The vulnerability of the BI Workspace module of the SAP BusinessObjects Business Intelligence platform allows a hacker to elevate their privileges by intercepting sessions or exposing protected information.

The vulnerability of the BI Workspace module of the SAP BusinessObjects Business Intelligence platform exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to elevate their privileges by intercepting sessions or disclose...

CVE-2020-6308

SAP BusinessObjects Business Intelligence Platform Web Services versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker c...

CVE-2020-6308

SAP BusinessObjects Business Intelligence Platform Web Services versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker c...

CVE-2020-6308

SAP BusinessObjects Business Intelligence Platform Web Services versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker c...

Server side request forgery (ssrf)

SAP BusinessObjects Business Intelligence Platform Web Services versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker c...

CVE-2020-6308

SAP BusinessObjects Business Intelligence Platform Web Services versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker c...

CVE-2020-6308

The SAP BusinessObjects Business Intelligence Platform (Web Services) versions 410, 420, and 430 are vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a lack of validation on the CMS function for the APS parameter , which allows an unauthenticated attacker to inject arbitrary...

PT-2020-19084 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Web Services versions 410, 420, 430 Description: The issue allows an unauthenticated attacker to inject arbitrary values as CMS parameters, enabling them to perform lookups on the internal...

CVE-2020-6308: Server-Side Request Forgery (SSRF)

SAP BusinessObjects Business Intelligence Platform Web Services versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker c...

The vulnerability of the CMC module of the SAP BusinessObjects Business Intelligence platform allows a hacker to disclose protected information or cause service interruptions.

The vulnerability of the CMC module of the SAP BusinessObjects Business Intelligence platform is related to errors in processing XML requests. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service failures...

The vulnerability of SAP BusinessObjects Business Intelligence platform, related to the lack of protection for operational data, allows attackers to disclose protected information.

The vulnerability of the SAP BusinessObjects Business Intelligence platform is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information remotely...

CVE-2020-6312

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site...

CVE-2020-6312

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site...