SAP Businessobjects Edge vulnerabilities

6 CVEs affecting SAP Businessobjects Edge, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-2074, published 2021-08-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-9320, published 2021-08-09. Critical severity, CVSS 9.8. EPSS: 4.2% chance of exploitation in the next 30 days. SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and consequently gain SYSTEM privileges via vectors involving CORBA calls, aka SAP Note…
CVE-2015-2073, published 2021-08-09. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. The File RepositoRy Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to read arbitrary files via a full pathname, aka SAP Note 2018682.
CVE-2015-7730, published 2015-10-15. High severity, CVSS 10.0. EPSS: 3.6% chance of exploitation in the next 30 days. SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of service (out-of-bounds read and listener crash) via a…
CVE-2015-2074, published 2021-08-09. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. The File Repository Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to write to arbitrary files via a full pathname, aka SAP Note 2018681.
CVE-2015-2075, published 2015-02-27. Medium severity, CVSS 5.0. EPSS: 2.8% chance of exploitation in the next 30 days. SAP BusinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396.
CVE-2015-2076, published 2015-02-27. Medium severity, CVSS 5.0. EPSS: 2.3% chance of exploitation in the next 30 days. The Auditing service in SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information by reading an audit event, aka SAP Note 2011395.