Businessobjects

This hub aggregates every CVE we track for Businessobjects, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Businessobjects.

• CVE-2023-40623Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)6.2Sep 12, 2023
• CVE-2023-28764Information Disclosure vulnerability in SAP BusinessObjects Platform3.7May 9, 2023
• CVE-2022-28214During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosu...7.8May 11, 2022
• CVE-2019-0303SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without ...6.1Jun 14, 2019
• CVE-2019-0289Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.7.1May 14, 2019
• CVE-2019-0287Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be rest...7.6May 14, 2019
• CVE-2019-0259SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation.9.8Feb 15, 2019
• CVE-2019-0251The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.6.1Feb 15, 2019
• CVE-2018-2408Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions creat...7.3Apr 10, 2018
• CVE-2017-16683Denial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could allow an attacker to prevent legitimate users from accessing a service.6.5Dec 12, 2017
• CVE-2015-7730SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of service (out-of-bounds read and listener crash) via a...10.0Oct 15, 2015
• CVE-2014-9387SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and gain privileges via a crafted CORBA call, aka SAP Note 2039905.10.0Dec 17, 2014
• CVE-2014-8310The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message.7.1Oct 16, 2014
• CVE-2014-8311SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener.3.5Oct 16, 2014
• CVE-2014-8309SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which a...5.0Oct 16, 2014