Vulnerabilities > SAP > Medium

DATE CVE VULNERABILITY TITLE RISK
2020-04-14 CVE-2020-6226 Cross-site Scripting vulnerability in SAP Businessobjects Business Intelligence Platform 4.2
SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
network
low complexity
sap CWE-79
5.4
2020-04-14 CVE-2020-6224 Information Exposure Through Log Files vulnerability in SAP Netweaver Application Server Java
SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data such as passwords in trace files, when the user logs in and sends request with login credentials, leading to Information Disclosure.
network
low complexity
sap CWE-532
6.2
2020-04-14 CVE-2020-6223 Open Redirect vulnerability in SAP Businessobjects Business Intelligence Platform 4.1/4.2
The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malicious content.
network
low complexity
sap CWE-601
6.1
2020-04-14 CVE-2020-6222 Cross-site Scripting vulnerability in SAP Businessobjects Business Intelligence Platform 4.1/4.2
SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
network
low complexity
sap CWE-79
5.4
2020-04-14 CVE-2020-6221 Cross-site Scripting vulnerability in SAP Businessobjects Business Intelligence Platform 4.1/4.2
Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
network
low complexity
sap CWE-79
5.4
2020-04-14 CVE-2020-6218 Unspecified vulnerability in SAP Businessobjects Business Intelligence Platform 4.1/4.2
Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should otherwise be restricted, leading to Information Disclosure.
network
low complexity
sap
5.0
2020-04-14 CVE-2020-6216 Cross-site Scripting vulnerability in SAP Businessobjects Business Intelligence Platform 4.2
SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
network
low complexity
sap CWE-79
6.1
2020-04-14 CVE-2020-6214 Incorrect Authorization vulnerability in SAP S/4Hana 100
SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports.
network
low complexity
sap CWE-863
4.7
2020-03-10 CVE-2020-6210 Cross-site Scripting vulnerability in SAP Fiori Launchpad 753/754
SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, leading to reflected Cross-Site Scripting (XSS) vulnerability.
network
low complexity
sap CWE-79
6.1
2020-03-10 CVE-2020-6206 Cross-Site Request Forgery (CSRF) vulnerability in SAP Cloud Platform Integration 1.0
SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages.
network
low complexity
sap CWE-352
4.3