SAP Crystal Reports vulnerabilities

7 CVEs affecting SAP Crystal Reports, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-6208, published 2020-03-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2010-2590, published 2010-12-22. High severity, CVSS 9.3. EPSS: 46.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix Pack 3.2 allows remote attackers to execute…
CVE-2019-0285, published 2019-04-10. Critical severity, CVSS 9.8. EPSS: 6.6% chance of exploitation in the next 30 days. The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.
CVE-2010-3032, published 2010-08-17. High severity, CVSS 10.0. EPSS: 6.4% chance of exploitation in the next 30 days. Integer overflow in the OBGIOPServerWorker::extractHeader function in the ebus-3-3-2-6.dll module in SAP Crystal Reports 2008 allows remote attackers to cause a denial of service (crash) and possibly…
CVE-2014-5505, published 2014-09-04. Medium severity, CVSS 6.8. EPSS: 3.8% chance of exploitation in the next 30 days. Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an RPT file.
CVE-2014-5506, published 2014-09-04. Medium severity, CVSS 6.8. EPSS: 3.1% chance of exploitation in the next 30 days. Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file.
CVE-2018-2427, published 2018-07-10. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 2010) allows an attacker to inject code that can be executed…
CVE-2020-6208, published 2020-03-10. High severity, CVSS 8.2. EPSS: 1.1% chance of exploitation in the next 30 days. SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus…