Vulnerabilities > SAP > Crystal Reports

DATE CVE VULNERABILITY TITLE RISK
2020-03-10 CVE-2020-6208 Code Injection vulnerability in SAP Crystal Reports 4.1/4.2
SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application, leading to Remote Code Execution.
local
sap CWE-94
4.4
2019-04-10 CVE-2019-0285 Cleartext Storage of Sensitive Information vulnerability in SAP Crystal Reports 2010
The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.
network
low complexity
sap CWE-312
5.0
2018-07-10 CVE-2018-2427 Code Injection vulnerability in SAP products
SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 2010) allows an attacker to inject code that can be executed by the application.
network
low complexity
sap CWE-94
6.5
2014-09-04 CVE-2014-5506 Remote Code Execution vulnerability in SAP Crystal Reports
Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file.
network
sap
6.8
2014-09-04 CVE-2014-5505 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in SAP Crystal Reports
Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an RPT file.
network
sap CWE-119
6.8
2010-12-22 CVE-2010-2590 Buffer Errors vulnerability in SAP Crystal Reports 2008
Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix Pack 3.2 allows remote attackers to execute arbitrary code via a long ServerResourceVersion property value.
network
sap CWE-119
critical
9.3
2010-08-17 CVE-2010-3032 Numeric Errors vulnerability in SAP Crystal Reports 2008
Integer overflow in the OBGIOPServerWorker::extractHeader function in the ebus-3-3-2-6.dll module in SAP Crystal Reports 2008 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a GIOP packet with a crafted size, which triggers a heap-based buffer overflow.
network
low complexity
sap CWE-189
critical
10.0