CVE-2020-25050: Undefined Security Weakness

An issue was discovered on Samsung mobile devices with P9.0 and Q10.0 software. The CMC service allows attackers to obtain sensitive information. The Samsung ID is SVE-2020-17288 August 2020...

CVE-2020-6300

CVE-2020-6300 affects SAP Business Objects BI Platform (Central Management Console), versions 4.2 and 4.3. The Root Cause is insufficient encoding of user-controlled inputs for the RecycleBin, enabling a Stored XSS vulnerability. An attacker with administrator rights can use the web app to send m...

Cross site scripting

SAP Business Objects Business Intelligence Platform BI Launchpad and CMC, versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting...

CVE-2020-6278: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform BI Launchpad and CMC, versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting...

Cross-site request forgery attack on change password form

Summary Change password doesn't validate CSRF token properly. Impact An attacker can force the victim to change password without knowing. To successfully complete this attack the victim needs to be logged to the Guardian/CMC and visit a special prepared page containing the forged change password...

Cross site scripting

SAP Business Objects Business Intelligence Platform CMC and BI Launchpad 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability...

CVE-2020-6257: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform CMC and BI Launchpad 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability...

CVE-2020-6195

The CVE-2020-6195 entry applies to SAP Business Objects Business Intelligence Platform (CMC) versions 4.1 and 4.2, where the response can contain a cleartext password. The underlying issue is information disclosure via exposed credentials, which, if exploited via social engineering to obtain a pa...

CVE-2020-6195: Cleartext Transmission of Sensitive Information

SAP Business Objects Business Intelligence Platform CMC, version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to...

Information disclosure

Certain settings pages in SAP Business Objects Business Intelligence Platform CMC, version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure...

CVE-2020-6189

CVE-2020-6189 affects SAP Business Objects Business Intelligence Platform (CMC) 4.2. The issue arises from certain settings pages generating error messages that can disclose enterprise private-network information that should be restricted, leading to information disclosure. The available document...

CVE-2020-6189

Certain settings pages in SAP Business Objects Business Intelligence Platform CMC, version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure...

CVE-2020-6189: Generation of Error Message Containing Sensitive Information

Certain settings pages in SAP Business Objects Business Intelligence Platform CMC, version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure...

Stored XSS in field name data model

Summary An attacker with admin access to the appliance can inject malicious code that will later be executed by another legitimate users. This allows an attacker to perform unauthorized actions on behalf of legitimate users. JavaScript injection was possible using the field name when adding new...

Information disclosure

IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CMC UI headers. IBM X-Force ID: 154284...

CVE-2018-1991

IBM API Connect 5.0.0.0–5.0.8.6 is affected by an information-disclosure vulnerability (CVE-2018-1991) that could reveal sensitive information about the underlying software stack via CMC UI headers. The root cause is a disclosure in requests/responses that exposes internal details. Affected produ...

CVE-2018-1991: Exposure of Sensitive Information to an Unauthorized Actor

IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CMC UI headers. IBM X-Force ID: 154284...

CVE-2019-0268

SAP BusinessObjects Business Intelligence Platform CMC Module, versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source...

CVE-2019-0268: XML Injection (aka Blind XPath Injection)

SAP BusinessObjects Business Intelligence Platform CMC Module, versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source...

Authentication Bypass

pki-core is vulnerable to authentication bypass attacks. The vulnerability exists as it was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the...