SAP Crystal Reports Server vulnerabilities

5 CVEs affecting SAP Crystal Reports Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-2406, published 2018-04-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-3346, published 2009-09-24. High severity, CVSS 10.0. EPSS: 3.9% chance of exploitation in the next 30 days. Unspecified vulnerability in SAP Crystal Reports Server 2008 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional…
CVE-2009-3345, published 2009-09-24. High severity, CVSS 10.0. EPSS: 1.6% chance of exploitation in the next 30 days. Heap-based buffer overflow in SAP Crystal Reports Server 2008 has unknown impact and attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of…
CVE-2009-3344, published 2009-09-24. Medium severity, CVSS 5.0. EPSS: 1.6% chance of exploitation in the next 30 days. Unspecified vulnerability in SAP Crystal Reports Server 2008 on Windows XP allows attackers to cause a denial of service (infinite loop) via unknown vectors, as demonstrated by a certain module in…
CVE-2011-4805, published 2011-12-14. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in pubDBLogon.jsp in SAP Crystal Report Server 2008 allows remote attackers to inject arbitrary web script or HTML via the service parameter.
CVE-2018-2406, published 2018-04-10. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.0, 4.10, 4.20, 4.30, startup path.