Sap Businessobjects Business Intelligence Platform vulnerabilities

CVE-2020-6226 [MEDIUM] CWE-79 CVE-2020-6226: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

CVE-2020-6223 [MEDIUM] CWE-601 CVE-2020-6223: The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malicious content. This can misdirect a user who is tricked into accessing these error pages rendered by the application, leading to Content Spoofing.

CVE-2020-6216 [MEDIUM] CWE-79 CVE-2020-6216: SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficient SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.

CVE-2020-6218 [MEDIUM] CVE-2020-6218: Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should otherwise be restricted, leading to Information Disclosure.

CVE-2020-6189 [MEDIUM] CWE-209 CVE-2020-6189: Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure.

CVE-2019-0398 [HIGH] CWE-352 CVE-2019-0398: Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to an authenticated user to send unintended request to the web server, leading to Cross Site Request Forgery.

CVE-2019-0395 [MEDIUM] CWE-79 CVE-2019-0395: SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI Launchpad, leading to Stored Cross Site Scripting vulnerability.

CVE-2019-0396 [HIGH] CWE-20 CVE-2019-0396: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in v SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML document accepted from an untrusted source. An attacker can craft a message that contains malicious elements that will not be correctly filtered by Web Intelligence HTML interface in some specific

CVE-2019-0382 [MEDIUM] CWE-79 CVE-2019-0382: A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (W A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related pages); corrected in version 4.2. Privileges are required in order to exploit this vulnerability.

CVE-2019-0377 [MEDIUM] CWE-79 CVE-2019-0377: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting.

CVE-2019-0376 [MEDIUM] CWE-79 CVE-2019-0376: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in the publication name, which can be executed later by the victim, resulting in Stored Cross-Site Scripting.

CVE-2019-0374 [MEDIUM] CWE-79 CVE-2019-0374: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title resulting in reflected Cross-Site Scripting

CVE-2019-0375 [MEDIUM] CWE-79 CVE-2019-0375: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the export dialog box of the report name resulting in reflected Cross-Site Scripting.

CVE-2019-0378 [MEDIUM] CWE-79 CVE-2019-0378: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting.

CVE-2019-0352 [HIGH] CWE-200 CVE-2019-0352: In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynam In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the sensitive information via cache and can open the dynamic pages even after logout.

CVE-2018-2471 [HIGH] CVE-2018-2471: Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 allows an Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 allows an attacker to access information which would otherwise be restricted.

CVE-2018-2397 [MEDIUM] CWE-79 CVE-2018-2397: In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Manageme In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) does not sufficiently encode user controlled inputs which results in Cross-Site Scripting.