cve,link,title,description,vendor,products,score,severity,epss,cisa,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2024-37179,https://securityvulnerability.io/vulnerability/CVE-2024-37179,SAP BusinessObjects Vulnerability Allows Data Theft,"SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service, causing high impact on confidentiality of the application.",SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence),6.5,MEDIUM,0.0004900000058114529,false,false,false,false,,false,false,2024-10-08T03:21:02.936Z,0
CVE-2023-42472,https://securityvulnerability.io/vulnerability/CVE-2023-42472,Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface),"This vulnerability in SAP BusinessObjects Business Intelligence Platform (specifically the Web Intelligence HTML interface) allows authenticated users to upload files from their local systems. If an attacker intercepts the upload request, they can modify the content type and file extension, leading to unauthorized access to sensitive data and potential integrity issues. This exploit underscores the critical need for robust file type validation to prevent malicious file executions and safeguard application confidentiality.",SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence Html Interface),8.7,HIGH,0.0006399999838322401,false,false,false,false,,false,false,2023-09-12T02:15:00.000Z,0
CVE-2021-21447,https://securityvulnerability.io/vulnerability/CVE-2021-21447,,"SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed by User who views the relevant application content, which leads to Stored Cross-Site Scripting.",SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence Html Interface),5.4,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2021-01-12T14:40:43.000Z,0
CVE-2020-6308,https://securityvulnerability.io/vulnerability/CVE-2020-6308,,"SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.",SAP,SAP Businessobjects Business Intelligence Platform (web Services),5.3,MEDIUM,0.008050000295042992,false,false,false,true,true,false,false,2020-10-20T13:31:10.000Z,0
CVE-2020-6312,https://securityvulnerability.io/vulnerability/CVE-2020-6312,,"SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site Scripting. In certain situations, when a user accesses an affected web page element, the attacker will be able to access or modify metadata for which they are not authorized.",SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence Html Interface),5.4,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2020-09-09T12:40:12.000Z,0
CVE-2020-6222,https://securityvulnerability.io/vulnerability/CVE-2020-6222,,"SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.",SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence Html Interface),5.4,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2020-04-14T18:18:10.000Z,0
CVE-2019-0396,https://securityvulnerability.io/vulnerability/CVE-2019-0396,,"SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML document accepted from an untrusted source. An attacker can craft a message that contains malicious elements that will not be correctly filtered by Web Intelligence HTML interface in some specific workflows.",SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence Html Interface),7.1,HIGH,0.0008500000112690032,false,false,false,false,,false,false,2019-11-13T22:18:04.000Z,0
CVE-2019-0382,https://securityvulnerability.io/vulnerability/CVE-2019-0382,,A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related pages); corrected in version 4.2. Privileges are required in order to exploit this vulnerability.,SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence),5.4,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2019-11-13T21:59:11.000Z,0
CVE-2019-0378,https://securityvulnerability.io/vulnerability/CVE-2019-0378,,"SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting.",SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence Html Interface),5.4,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2019-10-08T19:25:44.000Z,0
CVE-2019-0377,https://securityvulnerability.io/vulnerability/CVE-2019-0377,,"SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting.",SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence Html Interface),5.4,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2019-10-08T19:24:50.000Z,0
CVE-2019-0376,https://securityvulnerability.io/vulnerability/CVE-2019-0376,,"SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in the publication name, which can be executed later by the victim, resulting in Stored Cross-Site Scripting.",SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence Html Interface),5.4,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2019-10-08T19:23:56.000Z,0
CVE-2019-0375,https://securityvulnerability.io/vulnerability/CVE-2019-0375,,"SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the export dialog box of the report name resulting in reflected Cross-Site Scripting.",SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence Html Interface),5.4,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2019-10-08T19:22:26.000Z,0
CVE-2019-0374,https://securityvulnerability.io/vulnerability/CVE-2019-0374,,"SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title resulting in reflected Cross-Site Scripting",SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence Html Interface),5.4,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2019-10-08T19:21:30.000Z,0
CVE-2019-0333,https://securityvulnerability.io/vulnerability/CVE-2019-0333,,"In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile, resulting in Information Disclosure.",SAP,SAP Businessobjects Business Intelligence Platform (web Intelligence),6.5,MEDIUM,0.0006399999838322401,false,false,false,false,,false,false,2019-08-14T13:47:36.000Z,0