BU
Product
Businessobjects
23
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 4Low 0
Watch
Add Businessobjects to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-0259 | 9.8 | Feb 15 | SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation Affected: 4.2; 4.3 |
| CVE-2022-28214 | 7.8 | May 11 | During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs Affected: 420; 430 |
| CVE-2019-0287 | 7.6 | May 14 | Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access information which would… Affected: 4.2; 4.3 |
| CVE-2018-2408 | 7.3 | Apr 10 | Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad Affected: 4.0; 4.10; 4.20; 4.30 |
| CVE-2023-40623 | 7.1 | Sep 12 | SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with… Affected: 420; 430 |
| CVE-2019-0289 | 7.1 | May 14 | Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information which would… Affected: 4.2; 4.3 |
| CVE-2017-16683 | 6.5 | Dec 12 | Denial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could allow an attacker to prevent legitimate users from accessing a service Affected: 4.10; 4.20 |
| CVE-2019-0303 | 6.1 | Jun 14 | SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into… Affected: 4.2; 4.3 |
| CVE-2019-0251 | 6.1 | Feb 15 | The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability Affected: 4.2; 4.3 |
| CVE-2023-28764 | 5.9 | May 9 | SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network Affected: 4.20; 4.30 |
| CVE-2015-7730 | – | Oct 15 | SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of service (out-of-bounds read and… Affected: 4.1 |
| CVE-2014-9387 | – | Dec 17 | SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and gain privileges via a crafted CORBA call, aka SAP Note 2039905 Affected: 4.1 |
| CVE-2014-8311 | – | Oct 16 | SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener Affected: 4.0 |
| CVE-2014-8310 | – | Oct 16 | The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message Affected: 4.0 |
| CVE-2014-8309 | – | Oct 16 | SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user… Affected: 4.0 |
| CVE-2014-8308 | – | Oct 16 | Cross-site scripting (XSS) vulnerability in the Send to Inbox functionality in SAP BusinessObjects BI EDGE 4.0 allows remote attackers to inject arbitrary web script or HTML via… Affected: 4.0 |
| CVE-2014-3134 | – | Apr 30 | Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: All versions, or not specified |
| CVE-2010-3983 | – | Oct 18 | CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain privileges via vectors involving the Program Job Server and the Program Login property Affected: 3.2 |
| CVE-2010-3982 | – | Oct 18 | SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to trigger TCP connections to arbitrary intranet hosts on any port, and obtain potentially sensitive information… Affected: 3.2 |
| CVE-2010-3981 | – | Oct 18 | Cross-site scripting (XSS) vulnerability in SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to inject arbitrary web script or HTML via the ServiceClass field to the… Affected: 3.2 |
| CVE-2010-3980 | – | Oct 18 | Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 does not limit the number of CUIDs that may be requested, which allows remote authenticated users to cause a denial of service… Affected: 3.2 |
| CVE-2010-3979 | – | Oct 18 | Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 generates different error messages depending on whether the Login field corresponds to a valid username, which allows remote… Affected: 3.2 |
| CVE-2010-0219 | – | Oct 18 | Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account,… Affected: 3.2 |
Showing 23