SAP BusinessObjects Business Intelligence Platform BI CMC Security Bypass Vulnerability

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product has a report generation, analysis, data visualization, etc. BI CMC is one of the central management console program. A security...

CVE-2018-2483

SAP BusinessObjects BI Platform CMC (versions 4.1 and 4.2) is affected by HTTP Verb Tampering caused by how request methods can be manipulated. Vulnerable component: Central Management Console. Reported impact includes bypassing security restrictions and tampering with HTTP verbs. No explicit exp...

CVE-2017-7537

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates...

CVE-2018-2432

SAP BusinessObjects Business Intelligence BI Launchpad and Central Management Console versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including:...

pki-core security, bug fix, and enhancement update

10.5.1-13.1 - Rebuild due to build system database problem 10.5.1-13 - - RHEL 7.5: - - Bugzilla Bug 1553068 - Using a Netmask produces an odd entry in a certifcate rhel-7.5.z ftweedal - Bugzilla Bug 1585945 - CMC CRMF requests result in InvalidKeyFormatException when signing algorithm is ECC...

Scientific Linux Security Update : pki-core on SL7.x x86_64 (20180626)

Security Fixes : - pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access CVE-2018-1080 Bug Fixes : - Previously, when ECC keys were enrolled, Certificate Management over CMS CMC authentication failed with a 'TokenException: Unable to insert certificate...

CVE-2018-2408: Session Fixation

Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be active...

Cross site scripting

In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console CMC does not sufficiently encode user controlled inputs which results in Cross-Site Scripting...

CVE-2018-2397

In SAP Business Objects BI Platform, versions 4.00–4.30, the Central Management Console (CMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting. This is the concrete issue described across the CVE and connected records, with no explicit exploitation details or...

CVE-2018-2397: Improper Neutralization of Input During Web Page Generation

In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console CMC does not sufficiently encode user controlled inputs which results in Cross-Site Scripting...

EulerOS 2.0 SP2 : pki-core (EulerOS-SA-2017-1184)

According to the version of the pki-core packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package. An attack...

pki-core security update

10.4.1-11 - Resolves: rhbz 1469432 - - RHEL 7.4: - - Bugzilla Bug 1469432 - CMC plugin default change - Resolves CVE-2017-7537 - Fixes BZ 1470948...

pki-core: mock CMC authentication plugin with hardcoded secret enabled by default

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates...

CVE-2017-7537

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates...

SolarWinds Log and Event Manager Command Execution Vulnerability (CNVD-2017-06863)

SolarWinds Log and Event Manager is a log and event manager that provides real-time log analysis, memory event correlation, and threat attack response. A command execution vulnerability exists in SolarWinds Log and Event Manager 6.3.1, which can be exploited to execute arbitrary commands by loggi...

SolarWinds Log and Event Manager Information Disclosure Vulnerability

SolarWinds Log and Event Manager is a log and event manager that provides real-time log analysis, memory event correlation, and threat attack response. An information disclosure vulnerability exists in SolarWinds Log and Event Manager 6.3.1, which can be exploited by a local attacker to log in to...

SolarWinds Log and Event Manager Elevation of Privilege Vulnerability

SolarWinds Log and Event Manager is a log and event manager that provides real-time log analysis, memory event correlation, and threat attack response. A privilege acquisition vulnerability exists in SolarWinds Log and Event Manager version 6.3.1. This vulnerability can be exploited by a local...

SolarWinds Log and Event Manager < 6.3.1 Hotfix 4 Multiple Vulnerabilities

SolarWinds Log and Event Manager LEM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CMC CFD and Forex Trading App - Corrupted files, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application CMC CFD and Forex Trading App published at the 'play' market has multiple vulnerabilities...

CVE-2015-7840

CVE-2015-7840 affects the SolarWinds Log and Event Manager (LEM) command line management console (CMC) prior to version 6.2.0. The vulnerability allows remote attackers to execute arbitrary code via unspecified vectors involving the ping feature. Connected documents also reference CVE-2015-7839 a...