CVE-2018-2446

Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information server name, hence leading to an information disclosure...

CVE-2018-2447

SAP BusinessObjects Business Intelligence Launchpad Web Intelligence, version 4.2, allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects database...

CVE-2018-2446

Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information server name, hence leading to an information disclosure...

Information disclosure

Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information server name, hence leading to an information disclosure...

CVE-2018-2442

In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid...

Code injection

SAP BusinessObjects Business Intelligence Launchpad Web Intelligence, version 4.2, allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects database...

CVE-2018-2444

SAP BusinessObjects Financial Consolidation, versions 10.0, 10.1, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Cross site scripting

SAP BusinessObjects Financial Consolidation, versions 10.0, 10.1, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2444

SAP BusinessObjects Financial Consolidation, versions 10.0, 10.1, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Server side request forgery (ssrf)

AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting in a Server-Side Request Forgery SSRF vulnerability...

Design/Logic Flaw

In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid...

CVE-2018-2445

AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting in a Server-Side Request Forgery SSRF vulnerability...

CVE-2018-2445

AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting in a Server-Side Request Forgery SSRF vulnerability...

CVE-2018-2442

In SAP BusinessObjects Business Intelligence, versions 4.0, 4.1 and 4.2, while viewing a Web Intelligence report from BI Launchpad, the user session details captured by an HTTP analysis tool could be reused in a HTML page while the user session is still valid...

CVE-2018-2447

SAP BusinessObjects Business Intelligence Launchpad Web Intelligence, version 4.2, allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects database...

CVE-2018-2442

Summary of CVE-2018-2442 : In SAP BusinessObjects BI (versions 4.0–4.2), viewing a Web Intelligence report from BI Launchpad can reveal session details captured by an HTTP analysis tool, which may be reused in an HTML page while the user session remains valid. This describes a cross‑site request ...

CVE-2018-2446

Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information server name, hence leading to an information disclosure...

CVE-2018-2445

CVE-2018-2445 affects SAP BusinessObjects BI Admin Tools in SAP BI Platform (versions 4.1 and 4.2). The vulnerability is a Server-Side Request Forgery (SSRF) allowing an attacker to manipulate the application to send crafted requests on its behalf. CVSS details indicate high impact to confidentia...

CVE-2018-2446

SAP BusinessObjects BI Admin Tools (v4.1, v4.2) contains an information-disclosure issue where an unauthenticated user can read the server name. The root cause and exact impact are described as information disclosure in multiple sources, but the documents do not provide exploit specifics, affecte...

CVE-2018-2444

CVE-2018-2444 affects SAP BusinessObjects Financial Consolidation, versions 10.0 and 10.1. The vulnerability is a Cross-Site Scripting (XSS) flaw caused by insufficient encoding of user-controlled inputs. The CNVD/NVD entries describe a remote-exploitation scenario where an attacker could inject ...