Vulnerabilities > SAP > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-04-14 | CVE-2020-6227 | Improper Input Validation vulnerability in SAP Businessobjects Business Intelligence Platform 4.2 SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP packets to several services due to Improper Input Validation, allowing to forge additional entries in GLF log files. | 5.0 |
| 2020-04-14 | CVE-2020-6223 | Open Redirect vulnerability in SAP Businessobjects Business Intelligence Platform 4.1/4.2 The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malicious content. | 5.8 |
| 2020-04-14 | CVE-2020-6219 | Deserialization of Untrusted Data vulnerability in SAP products SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service and unauthorized execution of arbitrary commands, leading to Deserialization of Untrusted Data. | 6.5 |
| 2020-04-14 | CVE-2020-6218 | Unspecified vulnerability in SAP Businessobjects Business Intelligence Platform 4.1/4.2 Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should otherwise be restricted, leading to Information Disclosure. | 4.0 |
| 2020-04-14 | CVE-2020-6216 | Cross-site Scripting vulnerability in SAP Businessobjects Business Intelligence Platform 4.2 SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability. | 4.3 |
| 2020-04-14 | CVE-2020-6214 | Incorrect Authorization vulnerability in SAP S/4Hana 100 SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. | 6.5 |
| 2020-03-10 | CVE-2020-6210 | Cross-site Scripting vulnerability in SAP Fiori Launchpad 753/754 SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, leading to reflected Cross-Site Scripting (XSS) vulnerability. | 4.3 |
| 2020-03-10 | CVE-2020-6209 | Missing Authorization vulnerability in SAP Disclosure Management 10.1 SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts by a user with no roles, leading to Missing Authorization Check. | 6.0 |
| 2020-03-10 | CVE-2020-6208 | Code Injection vulnerability in SAP Crystal Reports 4.1/4.2 SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application, leading to Remote Code Execution. | 4.4 |
| 2020-03-10 | CVE-2020-6206 | Cross-Site Request Forgery (CSRF) vulnerability in SAP Cloud Platform Integration 1.0 SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. | 4.3 |