CVE-2020-6308: Server-Side Request Forgery (SSRF)

SAP BusinessObjects Business Intelligence Platform Web Services versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker c...

CVE-2020-6288

SAP Business Objects Business Intelligence Platform Web Intelligence HTML interface allows an attacker with edit document rights to upload any file including script files without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker c...

PT-2020-19078

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform affected versions not specified Description The issue allows an attacker with edit document rights to upload any file, including script files, without proper file format validation. This lead...

PT-2020-19086

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface versions 4.1, 4.2 Description The issue allows an attacker with a non-administrative user account that can edit certain web page properties to modify how a...

CVE-2020-6288: Unrestricted Upload of File with Dangerous Type

SAP Business Objects Business Intelligence Platform Web Intelligence HTML interface allows an attacker with edit document rights to upload any file including script files without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker c...

CVE-2020-6312: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site...

SAP Business Objects Business Intelligence Platform Access Control Error Vulnerability (CNVD-2020-62944)

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. An access control error vulnerability exists in Xvfb in SAP Business...

PT-2020-5167

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform versions 4.2, 4.3 Description The issue exists due to insufficient protection of the web page structure, allowing a remote attacker to conduct Cross-Site Scripting XSS attacks. An attacker wi...

CVE-2020-6294: Missing Authentication for Critical Function

Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user identity...

PT-2020-5177

Name of the Vulnerable Software and Affected Versions SAP S/4 HANA Fiori UI for General Ledger Accounting versions 103, 104 SAP Business Objects Business Intelligence Platform affected versions not specified Description The issue concerns a missing authorization check in the attachment service,...

CVE-2020-6300: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform Central Management Console, versions- 4.2, 4.3, allows an attacker with administrator rights can use the web application to send malicious code to a different end user victim, as it does not sufficiently encode user-controlled inputs for...

Unauthorized Access Vulnerability in Graffiti Intelligent Platform of Hangzhou Graffiti Technology Co.

Doodle Intelligence is a globalized intelligence platform, "AI+IoT" developer platform. An unauthorized access vulnerability exists in the Doodle Intelligence platform of Hangzhou Doodle Technology Company Limited, which can be exploited by attackers to obtain sensitive information...

SAP Business Objects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2020-41739)

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. A cross-site scripting vulnerability exists in SAP Business Objects...

CVE-2020-6278

SAP Business Objects Business Intelligence Platform BI Launchpad and CMC, versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting...

PT-2020-19069

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform version 4.2 Description The issue is related to insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting problem. Recommendations For version 4.2, update to a versio...

PT-2020-19070

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform BI Launchpad and CMC versions 4.1, 4.2 Description The issue allows an attacker to embed malicious scripts in the application while uploading images. These scripts get executed when the victi...

PT-2020-19073

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform BI Launchpad version 4.2 Description The issue is related to insufficient encoding of user-controlled inputs, resulting in reflected Cross-Site Scripting. This allows attackers to inject...

CVE-2020-6281: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform BI Launchpad, version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in Cross-Site Scripting...

CVE-2020-6276: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform bipodata, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability...

CVE-2020-6278: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform BI Launchpad and CMC, versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting...