BB
Product
Businessobjects Business Intelligence Platform
73
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 20Medium 46Low 0
Watch
Add Businessobjects Business Intelligence Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-6245 | 6.7 | May 12 | SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application… Affected: 4.2 |
| CVE-2026-24324 | 6.5 | Feb 10 | SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause… Affected: 430; 2025; 2027 |
| CVE-2025-0064 | 6.5 | Feb 11 | Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a… Affected: 430; 2025 |
| CVE-2025-0060 | 6.5 | Jan 14 | SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the… Affected: 420; 430; 2025 |
| CVE-2022-29619 | 6.5 | Jul 12 | Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of objects it doesn't… Affected: 420; 430 |
| CVE-2022-27671 | 6.5 | Apr 12 | A CSRF token visible in the URL may possibly lead to information disclosure vulnerability Affected: 420; 430 |
| CVE-2022-22541 | 6.5 | Apr 12 | SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational or OLAP connections Affected: 420; 430 |
| CVE-2020-6269 | 6.5 | Jun 10 | Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to… Affected: 4.2 |
| CVE-2020-6251 | 6.5 | May 12 | Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be… Affected: 4.2 |
| CVE-2025-25245 | 6.1 | Mar 11 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured Affected: 430; 2025 |
| CVE-2023-0018 | 6.1 | Jan 10 | Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic… Affected: 420; 430 |
| CVE-2022-28216 | 6.1 | Apr 12 | SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unauthenticated attacker due to improper… Affected: 420 |
| CVE-2020-6281 | 6.1 | Jul 14 | SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in Cross-Site Scripting Affected: 4.2 |
| CVE-2020-6276 | 6.1 | Jul 14 | SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability Affected: 4.2 |
| CVE-2020-6211 | 6.1 | Apr 14 | SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect users to a malicious site due to insufficient URL validation… Affected: 4.1; 4.2 |
| CVE-2020-6223 | 6.1 | Apr 14 | The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malicious content Affected: 4.1; 4.2 |
| CVE-2020-6216 | 6.1 | Apr 14 | SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting… Affected: 4.2 |
| CVE-2024-34684 | 6.0 | Jun 11 | On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to access the password of a… Affected: 420; 430; 440 |
| CVE-2022-35169 | 6.0 | Jul 12 | SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privilege to read and decrypt LCMBIAR file's password under certain… Affected: 420; 430 |
| CVE-2024-45281 | 5.8 | Sep 10 | DLL hijacking vulnerability in SAP BusinessObjects Business Intelligence Platform Affected: 430 |
| CVE-2021-42061 | 5.4 | Dec 14 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)… Affected: 420 |
| CVE-2021-33679 | 5.4 | Sep 14 | The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document,… Affected: 420 |
| CVE-2020-6312 | 5.4 | Sep 9 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit… Affected: 4.1; 4.2 |
| CVE-2020-6278 | 5.4 | Jul 14 | SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading… Affected: 4.1; 4.2 |
| CVE-2020-6257 | 5.4 | May 12 | SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability Affected: 4.2 |
| CVE-2020-6231 | 5.4 | Apr 14 | SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site… Affected: 4.2 |
| CVE-2020-6226 | 5.4 | Apr 14 | SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site… Affected: 4.2 |
| CVE-2020-6222 | 5.4 | Apr 14 | SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in… Affected: 4.1; 4.2 |
| CVE-2020-6221 | 5.4 | Apr 14 | Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in… Affected: 4.1; 4.2 |
| CVE-2019-0395 | 5.4 | Dec 11 | SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI Launchpad, leading to… Affected: before 4.2 |
| CVE-2019-0382 | 5.4 | Nov 13 | A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related pages); corrected in version 4.2 Affected: before 4.2 |
| CVE-2019-0378 | 5.4 | Oct 8 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an… Affected: 4.0; 4.1; 4.1; 4.1; 4.1 |
| CVE-2019-0377 | 5.4 | Oct 8 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an… Affected: 4.0; 4.1; 4.1; 4.1; 4.1 |
| CVE-2019-0376 | 5.4 | Oct 8 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows… Affected: 4.0; 4.1; 4.1; 4.1; 4.1; 4.2; +3 more |
| CVE-2019-0375 | 5.4 | Oct 8 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows… Affected: 4.0; 4.1; 4.1; 4.1; 4.1; 4.2; +3 more |
| CVE-2019-0374 | 5.4 | Oct 8 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows… Affected: 4.0; 4.1; 4.1; 4.1; 4.1; 4.2; +3 more |
| CVE-2018-2397 | 5.4 | Mar 14 | In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) does not sufficiently encode user controlled inputs which… Affected: 4.00; 4.10; 4.20; 4.30 |
| CVE-2025-42988 | 5.3 | Jun 10 | Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially… Affected: 430; 2025; 2027 |
| CVE-2024-32732 | 5.3 | Dec 10 | Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This has low impact on… Affected: 430; 2025 |
| CVE-2022-39014 | 5.3 | Sep 13 | Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attacker to access certain unencrypted… Affected: 430 |
| CVE-2020-6308 | 5.3 | Oct 20 | SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to… Affected: 4.1; 4.2; 4.3 |
| CVE-2020-6288 | 5.3 | Sep 9 | SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload any file (including script files)… Affected: 4.1; 4.2 |
| CVE-2020-6189 | 5.3 | Feb 12 | Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related… Affected: 4.2 |
| CVE-2020-6218 | 5.0 | Apr 14 | Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should otherwise be… Affected: 4.1; 4.2 |
| CVE-2020-6300 | 4.8 | Aug 12 | SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator rights can use the web application to… Affected: 4.2; 4.3 |
| CVE-2024-33004 | 4.3 | May 14 | SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out Affected: 430; 440 |
Showing 46