BB
Product
Businessobjects Business Intelligence Platform
73
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 20Medium 46Low 0
Watch
Add Businessobjects Business Intelligence Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-6242 | 9.8 | May 12 | SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without… Affected: 1.0; 2.0; 2.1; 2.2; 2.3 |
| CVE-2020-6195 | 9.8 | Apr 14 | SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure Affected: 4.1; 4.2 |
| CVE-2020-26831 | 9.6 | Dec 9 | SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing… Affected: 4.1; 4.2; 4.3 |
| CVE-2024-28165 | 9.3 | May 14 | SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high… Affected: 430; 440 |
| CVE-2025-0061 | 9.1 | Jan 14 | SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an… Affected: 420; 430; 2025 |
| CVE-2023-24530 | 9.1 | Feb 14 | SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application… Affected: 420; 430 |
| CVE-2020-6294 | 9.1 | Aug 12 | Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user… Affected: 4.2; 4.3 |
| CVE-2023-0022 | 8.8 | Jan 10 | SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the… Affected: 420; 430 |
| CVE-2022-35228 | 8.8 | Jul 12 | SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted Affected: 420; 430 |
| CVE-2020-6219 | 8.8 | Apr 14 | SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic… Affected: 4.1; 4.2 |
| CVE-2019-0398 | 8.8 | Dec 11 | Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to an authenticated… Affected: 4.1; 4.2; 4.3 |
| CVE-2026-0508 | 8.1 | Feb 10 | The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application Affected: 430; 2025; 2027 |
| CVE-2022-28213 | 8.1 | Apr 12 | When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an… Affected: 420; 430 |
| CVE-2026-0490 | 7.5 | Feb 10 | SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, which prevents the… Affected: 430; 2025; 2027 |
| CVE-2026-0485 | 7.5 | Feb 10 | SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and… Affected: 430; 2025; 2027 |
| CVE-2023-27271 | 7.5 | Mar 14 | In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect… Affected: 420; 430 |
| CVE-2022-27667 | 7.5 | Apr 12 | Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access information which would… Affected: 430 |
| CVE-2021-40500 | 7.5 | Oct 12 | SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations at endpoints to… Affected: 4.20; 4.30 |
| CVE-2020-6247 | 7.5 | May 12 | SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service Affected: 4.2 |
| CVE-2020-6237 | 7.5 | Apr 14 | Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web application allows an attacker to access information which would… Affected: 4.1; 4.2 |
| CVE-2020-6227 | 7.5 | Apr 14 | SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP packets to several services due to… Affected: 4.2 |
| CVE-2019-0352 | 7.5 | Sep 10 | In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the… Affected: 4.10; 4.20; 4.30 |
| CVE-2018-2471 | 7.5 | Oct 9 | Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 allows an attacker to access information which would otherwise be restricted Affected: 4.10; 4.20 |
| CVE-2023-42472 | 7.3 | Sep 12 | Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report creator to upload… Affected: 420 |
| CVE-2025-31332 | 7.1 | Apr 8 | Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting… Affected: 430 |
| CVE-2023-0020 | 7.1 | Feb 14 | SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted Affected: 420; 430 |
| CVE-2019-0396 | 7.1 | Nov 13 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML document accepted… Affected: 4.0; 4.1; 4.1; 4.1 |
| CVE-2020-6245 | 6.7 | May 12 | SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application… Affected: 4.2 |
| CVE-2026-24324 | 6.5 | Feb 10 | SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause… Affected: 430; 2025; 2027 |
| CVE-2025-0064 | 6.5 | Feb 11 | Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a… Affected: 430; 2025 |
| CVE-2025-0060 | 6.5 | Jan 14 | SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the… Affected: 420; 430; 2025 |
| CVE-2022-29619 | 6.5 | Jul 12 | Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of objects it doesn't… Affected: 420; 430 |
| CVE-2022-27671 | 6.5 | Apr 12 | A CSRF token visible in the URL may possibly lead to information disclosure vulnerability Affected: 420; 430 |
| CVE-2022-22541 | 6.5 | Apr 12 | SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational or OLAP connections Affected: 420; 430 |
| CVE-2020-6269 | 6.5 | Jun 10 | Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to… Affected: 4.2 |
| CVE-2020-6251 | 6.5 | May 12 | Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be… Affected: 4.2 |
| CVE-2025-25245 | 6.1 | Mar 11 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured Affected: 430; 2025 |
| CVE-2023-0018 | 6.1 | Jan 10 | Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic… Affected: 420; 430 |
| CVE-2022-28216 | 6.1 | Apr 12 | SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unauthenticated attacker due to improper… Affected: 420 |
| CVE-2020-6281 | 6.1 | Jul 14 | SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in Cross-Site Scripting Affected: 4.2 |
| CVE-2020-6276 | 6.1 | Jul 14 | SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability Affected: 4.2 |
| CVE-2020-6211 | 6.1 | Apr 14 | SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect users to a malicious site due to insufficient URL validation… Affected: 4.1; 4.2 |
| CVE-2020-6223 | 6.1 | Apr 14 | The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malicious content Affected: 4.1; 4.2 |
| CVE-2020-6216 | 6.1 | Apr 14 | SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting… Affected: 4.2 |
| CVE-2024-34684 | 6.0 | Jun 11 | On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to access the password of a… Affected: 420; 430; 440 |
| CVE-2022-35169 | 6.0 | Jul 12 | SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privilege to read and decrypt LCMBIAR file's password under certain… Affected: 420; 430 |
| CVE-2024-45281 | 5.8 | Sep 10 | DLL hijacking vulnerability in SAP BusinessObjects Business Intelligence Platform Affected: 430 |
| CVE-2021-42061 | 5.4 | Dec 14 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)… Affected: 420 |
| CVE-2021-33679 | 5.4 | Sep 14 | The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document,… Affected: 420 |
| CVE-2020-6312 | 5.4 | Sep 9 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit… Affected: 4.1; 4.2 |