Authentication flaw

Under certain conditions SAP BusinessObjects Business Intelligence platform Analysis for OLAP, versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted...

CVE-2019-0289

Under certain conditions SAP BusinessObjects Business Intelligence platform Analysis for OLAP, versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted...

CVE-2019-0289

CVE-2019-0289 affects SAP BusinessObjects Business Intelligence Platform (Analysis for OLAP), specifically versions 4.2 and 4.3, where an attacker can access information that should be restricted. The provided documents confirm the affected product and the information disclosure impact but do not...

CVE-2019-0287

Under certain conditions SAP BusinessObjects Business Intelligence platform Central Management Server, versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted...

The vulnerability of SAP BusinessObjects Business Intelligence platform, related to the unlimited download of dangerous files, allows a hacker to execute arbitrary code.

The vulnerability of SAP BusinessObjects Business Intelligence platform is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Arbitrary Code Execution

The SAP BusinessObjects product which deploys Axis2 is vulnerable to arbitrary code execution. It is possible because it uses a default password for the administrator account, allowing anyone with access to the Axis2 port to gain full access to the machine and execute an arbitrary code. Note:...

CVE-2019-0269

SAP BusinessObjects Business Intelligence Platform BI Workspace, versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Cross site scripting

SAP BusinessObjects Business Intelligence Platform BI Workspace, versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0268

SAP BusinessObjects Business Intelligence Platform CMC Module, versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source...

CVE-2019-0268

SAP BusinessObjects Business Intelligence Platform CMC Module, versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source...

CVE-2019-0269

SAP BusinessObjects Business Intelligence Platform BI Workspace, versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Design/Logic Flaw

SAP BusinessObjects Business Intelligence Platform CMC Module, versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source...

CVE-2019-0268

SAP BusinessObjects Business Intelligence Platform CMC Module, versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source...

CVE-2019-0269

CVE-2019-0269 describes a cross-site scripting vulnerability in SAP BusinessObjects BI Platform (BI Workspace) affecting versions 4.10 and 4.20 . It results from insufficient encoding of user-controlled inputs , enabling potential execution of arbitrary script in a user’s browser within the affec...

CVE-2019-0268

CVE-2019-0268 affects SAP BusinessObjects Business Intelligence Platform (CMC Module) versions 4.10, 4.20 and 4.30. The root cause is inadequate validation of an XML document received from an untrusted source, exposing an XML External Entity-style weakness. Documents in connected sources corrobor...

CVE-2019-0259

SAP BusinessObjects, versions 4.2 and 4.3, Visual Difference allows an attacker to upload any file including script files without proper file format validation...

CVE-2019-0251

The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0251

The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Input validation

SAP BusinessObjects, versions 4.2 and 4.3, Visual Difference allows an attacker to upload any file including script files without proper file format validation...

Cross site scripting

The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...