SAP SE / Businessobjects
23 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2023-40623 | Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer) | HIGH | 7.1 | Sep 12, 2023 |
| CVE-2023-28764 | Information Disclosure vulnerability in SAP BusinessObjects Platform | MEDIUM | 5.9 | May 9, 2023 |
| CVE-2022-28214 | During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon… | HIGH | 7.8 | May 11, 2022 |
| CVE-2019-0303 | SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter… | MEDIUM | 6.1 | Jun 14, 2019 |
| CVE-2019-0289 | Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information… | HIGH | 7.1 | May 14, 2019 |
| CVE-2019-0287 | Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access inf… | HIGH | 7.6 | May 14, 2019 |
| CVE-2019-0259 | SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format valida… | CRITICAL | 9.8 | Feb 15, 2019 |
| CVE-2019-0251 | The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting… | MEDIUM | 6.1 | Feb 15, 2019 |
| CVE-2018-2408 | Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a… | HIGH | 7.3 | Apr 10, 2018 |
| CVE-2017-16683 | Denial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could allow an attacker to prevent legitimate users from accessing a s… | MEDIUM | 6.5 | Dec 12, 2017 |
| CVE-2015-7730 | SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of service (out-of… | HIGH | 10.0 | Oct 15, 2015 |
| CVE-2014-9387 | SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and gain privileges via a crafted CORBA call, ak… | HIGH | 10.0 | Dec 17, 2014 |
| CVE-2014-8311 | SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener. | LOW | 3.5 | Oct 16, 2014 |
| CVE-2014-8310 | The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Sessi… | HIGH | 7.1 | Oct 16, 2014 |
| CVE-2014-8309 | SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on wh… | MEDIUM | 5.0 | Oct 16, 2014 |
| CVE-2014-8308 | Cross-site scripting (XSS) vulnerability in the Send to Inbox functionality in SAP BusinessObjects BI EDGE 4.0 allows remote attackers to inject arbitrary web… | MEDIUM | 4.3 | Oct 16, 2014 |
| CVE-2014-3134 | Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via… | MEDIUM | 4.3 | Apr 30, 2014 |
| CVE-2010-3983 | CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain privileges via vectors involving the Program Job Server and the Progr… | HIGH | 9.0 | Oct 18, 2010 |
| CVE-2010-3982 | SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to trigger TCP connections to arbitrary intranet hosts on any port, and obtain potentially sensit… | MEDIUM | 5.0 | Oct 18, 2010 |
| CVE-2010-3981 | Cross-site scripting (XSS) vulnerability in SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to inject arbitrary web script or HTML via the Servic… | MEDIUM | 4.3 | Oct 18, 2010 |
| CVE-2010-3980 | Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 does not limit the number of CUIDs that may be requested, which allows remote authenticated users to cause a… | MEDIUM | 4.0 | Oct 18, 2010 |
| CVE-2010-3979 | Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 generates different error messages depending on whether the Login field corresponds to a valid username, whi… | MEDIUM | 5.0 | Oct 18, 2010 |
| CVE-2010-0219 | Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for t… | HIGH | 10.0 | Oct 18, 2010 |
Showing 1 to 23 of 23 CVEs