CVE-2020-6312

The CVE-2020-6312 entry concerns SAP BusinessObjects BI Platform (Web Intelligence HTML interface), affected in version 4.1 and 4.2. A non-administrative user who can edit certain web page properties can influence how the browser processes specific elements, enabling stored Cross-Site Scripting a...

CVE-2023-42472

CVE-2023-42472 affects SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface (v420). Root cause: insufficient file type validation during image file upload, enabling an authenticated attacker to intercept requests and modify content type/extension to read/modify sensi...

CVE-2025-25245

CVE-2025-25245 affects SAP BusinessObjects BI Platform (Web Intelligence). A deprecated web application endpoint that is not properly secured allows injection of a malicious URL via data returned to the user, enabling cross-site scripting within the victim’s browser. Impacts are limited to confid...

CVE-2024-45281

CVE-2024-45281 affects SAP BusinessObjects BI Platform. It describes a DLL hijacking vulnerability where a high-privilege local user can cause client desktop applications to run using unsigned or broken DLLs, compromising confidentiality and integrity. Local access is required; impact is high for...

CVE-2025-42988

CVE-2025-42988 affects SAP Business Objects Business Intelligence Platform. The issue allows an unauthenticated attacker to enumerate HTTP endpoints on the internal network by crafting specific HTTP requests, enabling information disclosure that could facilitate SSRF. The provided documents descr...

CVE-2019-0382

CVE-2019-0382 affects SAP BusinessObjects Business Intelligence Platform, specifically the Web Intelligence publication-related pages. The vulnerability is a Cross-Site Scripting flaw caused by insufficient input sanitization, allowing an attacker with the required privileges to exploit it. Corre...

CVE-2020-6300

CVE-2020-6300 affects SAP Business Objects BI Platform (Central Management Console), versions 4.2 and 4.3. The Root Cause is insufficient encoding of user-controlled inputs for the RecycleBin, enabling a Stored XSS vulnerability. An attacker with administrator rights can use the web app to send m...

CVE-2021-40500

CVE-2021-40500 affects SAP BusinessObjects BI Platform (Crystal Reports) versions 420 and 430. The issue stems from missing XML validations at network-exposed endpoints, allowing an unauthenticated attacker to read sensitive data and potentially retrieve arbitrary files from the server. The conne...

CVE-2020-6237

SAP Business Objects Business Intelligence Platform Information Disclosure (CVE-2020-6237) affects version 4.1 and 4.2 via the dswsbobje web application, allowing access to restricted information under certain conditions. The vulnerability is described as an information disclosure issue; no concr...

CVE-2020-6288

The CVE-2020-6288 issue affects SAP Business Objects BI Platform (Web Intelligence HTML interface): an attacker with edit-doc rights can upload any file (including scripts) due to insufficient file-format validation, enabling unrestricted upload of dangerous file types and allowing modification o...

CVE-2018-2397

In SAP Business Objects BI Platform, versions 4.00–4.30, the Central Management Console (CMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting. This is the concrete issue described across the CVE and connected records, with no explicit exploitation details or...

CVE-2020-26831

SAP BusinessObjects BI Platform (Crystal Report) versions 4.1–4.3 contain an XML validation flaw in crystal report generation, allowing an attacker with basic privileges to inject arbitrary XML entities and cause internal file disclosure, internal directory disclosure, SSRF, and DoS. The root cau...

CVE-2021-42061

This CVE concerns SAP BusinessObjects BI Platform (Web Intelligence) version 420, where insufficient encoding of user-controlled inputs leads to a Cross-Site Scripting (XSS) vulnerability. According to sources, a low-privileged attacker can retrieve some data from the victim without altering docu...

CVE-2026-24324

The CVE-2026-24324 entry concerns SAP BusinessObjects BI Platform (AdminTools). An authenticated user can execute a specific AdminTools query that crashes the Content Management Server (CMS), causing denial of service and impacting availability; confidentiality and integrity are not affected per ...

CVE-2020-6269

The CVE-2020-6269 entry concerns SAP Business Objects Business Intelligence Platform 4.2 and an information disclosure vulnerability. The connected documents indicate that under certain conditions, an attacker could access information that should be restricted. Concrete technical details such as ...

CVE-2020-6276

SAP Business Objects Business Intelligence Platform bipodata (v4.2) is affected by a Cross-Site Scripting vulnerability due to insufficient encoding of user-controlled inputs. The issue arises in the WEB application, enabling an attacker to trigger client-side code execution. Root cause: lack of ...

CVE-2020-6294

The CVE-2020-6294 vulnerability affects SAP Business Objects Business Intelligence Platform (BOBJ) Xvfb on Unix, specifically versions 4.2 and 4.3. The root cause is insufficient access control in the Xvfb server, leading to a lack of authentication checks for functionalities that require user id...

CVE-2020-6281

CVE-2020-6281 affects SAP Business Objects Business Intelligence Platform (BI Launchpad) v4.2. The issue is insufficient encoding of user-controlled inputs, leading to reflected cross-site scripting. The connected documents consistently describe a client-side data validation/encoding problem in B...

CVE-2025-0060

CVE-2025-0060 relates to SAP BusinessObjects BI Platform. The provided documents describe a vulnerability where an authenticated user with restricted access can inject malicious JavaScript code, enabling reading of sensitive information from the server and exfiltration to an attacker. The attacke...

CVE-2018-2471

CVE-2018-2471 affects SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20. The connected sources describe an information disclosure vulnerability that could allow an attacker to access information that would otherwise be restricted. The provided documents do not specify the underlyin...

CVE-2026-0508

The CVE refers to SAP BusinessObjects Business Intelligence Platform where an authenticated, high-privileged attacker can insert a malicious URL in the app. When a victim clicks it, an unvalidated redirect to the attacker-controlled domain occurs, potentially downloading malicious content. The im...

CVE-2026-0485

The CVE-2026-0485 entry relates to SAP BusinessObjects BI Platform where an unauthenticated attacker can send specially crafted requests that cause the Content Management Server (CMS) to crash and restart, leading to persistent unavailability. The impact is strictly on availability with confident...

CVE-2026-0490

CVE-2026-0490 affects SAP BusinessObjects BI Platform. An unauthenticated attacker can craft a specific network request to a trusted endpoint that breaks authentication, resulting in a high impact on availability and no impact on confidentiality or integrity. CVSS v3.1 metrics: AV:N/AC:L/PR:N/UI:...