Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2541▼ 407 respecto a la semana anterior
Críticas / altas1311▲ 28 respecto a la semana anterior
Nueva explotación activa (KEV)6▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)59▼ 467 respecto a la semana anterior
8 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Analizada | Media (6.5) | 0.42% | — | SAP Businessobjects WEB Intelligence | 9/4/2024 | 17/6/2026 | Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application. | |
| Modificada | Media (6.8) | 0.57% | — | SAP Businessobjects WEB Intelligence | 12/12/2023 | 17/6/2026 | SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. Successful exploitation can lead to exposure of the data that the user has access to.… | |
| Modificada | Media (5.4) | 0.33% | — | SAP Businessobjects WEB Intelligence | 10/10/2023 | 17/6/2026 | SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information. | |
| Modificada | Media (5.4) | 0.49% | — | SAP Businessobjects WEB Intelligence | 9/2/2022 | 17/6/2026 | Due to improper HTML encoding in input control summary, an authorized attacker can execute XSS vulnerability in SAP Business Objects Web Intelligence (BI Launchpad) - version 420. | |
| Modificada | Media (4.3) | 0.66% | — | SAP Businessobjects WEB Intelligence | 14/7/2021 | 17/6/2026 | Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp source code, through SDK calls, of Analytical Reporting bundle, a part of the frontend application, which would otherwise be restricted. | |
| Modificada | Media (5.4) | 0.76% | — | Sysjust CTS WEB | 28/5/2021 | 17/6/2026 | The CTS Web transaction system related to authentication management is implemented incorrectly. After login, remote attackers can manipulate cookies to access other accounts and trade in the stock market with spoofed identity. | |
| Modificada | Media (6.1) | 0.68% | — | Sysjust CTS WEB | 28/5/2021 | 17/6/2026 | The parameters of the specific functions in the CTS Web trading system do not filter special characters, which allows unauthenticated attackers can remotely perform reflected XSS and obtain the users’ connection token that triggered the attack. | |
| Modificada | Media (5.3) | 1.5% | — | Sysjust CTS WEB | 28/5/2021 | 17/6/2026 | The CTS Web transaction system related to authentication and session management is implemented incorrectly, which allows remote unauthenticated attackers can send a large number of valid usernames, and force those logged-in account to log out, causing the user to be unable to access the services |