CVE-2019-0378

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting...

CVE-2019-0374

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title resulting in reflected Cross-Site Scripting...

CVE-2019-0377

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting...

Cross site scripting

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title resulting in reflected Cross-Site Scripting...

Cross site scripting

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting...

Cross site scripting

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting...

Cross site scripting

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the export dialog box of the report name resulting in reflected Cross-Site Scripting...

CVE-2019-0378

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting...

CVE-2019-0378

Summary: CVE-2019-0378 affects SAP BusinessObjects BI Platform (Web Intelligence HTML interface) prior to version 4.2. The issue is due to insufficient encoding of user-controlled inputs, enabling an attacker to store malicious scripts in the filename of a background image, resulting in a Stored ...

CVE-2019-0377

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting...

CVE-2019-0377

CVE-2019-0377 affects SAP BusinessObjects BI Platform (Web Intelligence HTML interface) and is disclosed as a stored cross-site scripting vulnerability in versions before 4.2. The root cause, as described in several connected sources, is insufficient encoding of user-controlled inputs in the inpu...

CVE-2019-0376

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in the publication name, which can be executed later by the victim, resulting in...

CVE-2019-0376

SAP BusinessObjects BI Platform (Web Intelligence HTML interface) is affected by CVE-2019-0376. Affected versions are before 4.2 and 4.3, where user input in publication names is not sufficiently encoded, enabling stored cross-site scripting: an attacker can save malicious scripts in a publicatio...

CVE-2019-0375

CVE-2019-0375 affects SAP BusinessObjects BI Platform (Web Intelligence HTML interface). The issue is caused by insufficient encoding of user-controlled inputs, allowing reflected Cross-Site Scripting via the export dialog box for report names in versions prior to 4.2 and 4.3. The connected docum...

CVE-2019-0374

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title resulting in reflected Cross-Site Scripting...

CVE-2019-0374

SAP BusinessObjects BI Platform (Web Intelligence HTML interface) is affected by CVE-2019-0374. Versions prior to 4.2 and 4.3 fail to properly encode user-controlled inputs, allowing scripts to be executed in chart titles and resulting in reflected Cross-Site Scripting. Root cause: insufficient e...

PT-2019-4304

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface versions prior to 4.2 and 4.3 Description The issue is related to insufficient encoding of user-controlled inputs in the Web Intelligence HTML interface, allowi...

SAP BusinessObjects Business Intelligence Platform Multiple Cross Site Scripting Vulnerabilities

Description SAP BusinessObjects Business Intelligence Platform is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. Remote attackers can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in...

PT-2019-4306

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform versions prior to 4.2 and 4.3 Description The issue is related to the lack of input sanitization in the Web Intelligence HTML interface of the SAP BusinessObjects Business Intelligence platfor...

PT-2019-4308

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface versions prior to 4.2 Description The issue is related to insufficient encoding of user-controlled inputs, allowing an attacker to store malicious scripts in th...