CVE-2020-6308-PoC

CVE-2020-6308 SAP POC SAP BusinessObjects Business Intelligence PlatformWeb Services 버전 410, 420, 430은 인증되지 않은 공격자가 CMS 매개변수로 임의의 값을 주입하여 외부에서는 접근할 수 없는 내부 네트워크에 대한 조회를 수행할 수 있게 합니다. 질문이 있으면 트위터 팔로우 또는 DM을 보내주세요: https://twitter.com/initroott 저는 2020년 5월에 이 문제를 SAP에 보고했고, 패치는 2020년 10월에 릴리스되었습니다...

EUVD-2014-8156

Malware in sbrugna...

EUVD-2008-1894

Malware in sbrugna...

CVE-2020-6308

SAP BusinessObjects Business Intelligence Platform Web Services versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker c...

CVE-2023-27894

SAP BusinessObjects Business Intelligence Platform Web Services - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal...

Exploit for Server-Side Request Forgery in Sap Businessobjects_Business_Intelligence_Platform

CVE-2020-6308 SAP POC !Follow on Twitterhttps://img.shields...

CVE-2014-8315

polestarxml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and port in the cms parameter...

Code injection

polestarxml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and port in the cms parameter...

PT-2014-8464

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Explorer version 14.0.5 build 882 Description The issue allows remote attackers to conduct port scanning attacks. This is achieved by exploiting the polestar xml.jsp file, which replies with different timing depending on...

CVE-2014-8315: Exposure of Sensitive Information to an Unauthorized Actor

polestarxml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and port in the cms parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter...

CVE-2008-1894

Cross-site scripting XSS vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter...

CVE-2008-1894: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter...

CVE-2007-1707: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in Net Side Content Management System Net-Side.net CMS allows remote attackers to execute arbitrary PHP code via a URL in the cms parameter...