CVE-2018-2444

SAP BusinessObjects Financial Consolidation, versions 10.0, 10.1, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2447

SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence) 4.2 is affected by CVE-2018-2447. The vulnerability allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects database. Root cause is not fully detailed in the provided sources, but the impact is d...

CVE-2018-2445

AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting in a Server-Side Request Forgery SSRF vulnerability...

Design/Logic Flaw

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports version for Visual Studio .NET, Version 2010 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application...

CVE-2018-2432

SAP BusinessObjects Business Intelligence BI Launchpad and Central Management Console versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including:...

CVE-2018-2427

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports version for Visual Studio .NET, Version 2010 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application...

Cross site scripting

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2427

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports version for Visual Studio .NET, Version 2010 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application...

CVE-2018-2431

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2432

SAP BusinessObjects Business Intelligence BI Launchpad and Central Management Console versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including:...

CVE-2018-2431

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Cross site scripting

SAP BusinessObjects Business Intelligence BI Launchpad and Central Management Console versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including:...

CVE-2018-2432

SAP BusinessObjects Business Intelligence BI Launchpad and Central Management Console versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including:...

CVE-2018-2431

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2427

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports version for Visual Studio .NET, Version 2010 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application...

CVE-2018-2427

Public documents in the provided set do not disclose detailed technical specifics (affected components, root cause, or remediation) for CVE-2018-2427. Monitor for updates.

CVE-2018-2432

CVE-2018-2432 affects SAP BusinessObjects BI Launchpad and Central Management Console (versions 4.10, 4.20, 4.30). The issue allows an attacker to include invalid data in the HTTP response header sent to a web user, enabling cross-site scripting and page hijacking as stated in the public descript...

CVE-2018-2431

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, contains an XSS vulnerability caused by insufficient encoding of user-controlled inputs. The root cause is improper encoding in the affected web-facing components, enabling cross-site scripting. The connected documents do no...

Unspecified Cross-Site Scripting Vulnerability in SAP BusinessObjects Analysis for OLAP

The SAP BusinessObjects portfolio offers a wide range of business intelligence software, information management software, enterprise performance management solutions, and regulatory, risk, and compliance solutions. An unspecified cross-site scripting vulnerability exists in SAP BusinessObjects...

SAP Web Intelligence BI Launchpad SSRF Security Bypass Vulnerability

SAP BusinessObjects BI Platform is the German SAP SAP company's set of business intelligence BI solution platform. An SSRF security bypass vulnerability exists in SAP Web Intelligence BI Launchpad. An attacker can exploit the vulnerability to perform unauthorized actions, leading to further attac...