CVE-2014-8316

XML External Entity (XXE) vulnerability in polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate request.

• http://packetstormsecurity.com/files/128633/SAP-BusinessObjects-Explorer-14.0.5-XXE-Injection.htmlExploit
• http://scn.sap.com/docs/DOC-55451Vendor Advisory
• http://seclists.org/fulldisclosure/2014/Oct/50Exploit
• http://www.csnc.ch/misc/files/advisories/CSNC-2013-018_SAP_BusinessObjects_Explorer_XXE.txtExploit
• http://www.securityfocus.com/archive/1/533673/100/0/threaded
• http://www.securityfocus.com/bid/70384
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96933
• https://service.sap.com/sap/support/notes/1908531Vendor Advisory
• http://packetstormsecurity.com/files/128633/SAP-BusinessObjects-Explorer-14.0.5-XXE-Injection.htmlExploit
• http://scn.sap.com/docs/DOC-55451Vendor Advisory
• http://seclists.org/fulldisclosure/2014/Oct/50Exploit
• http://www.csnc.ch/misc/files/advisories/CSNC-2013-018_SAP_BusinessObjects_Explorer_XXE.txtExploit
• http://www.securityfocus.com/archive/1/533673/100/0/threaded
• http://www.securityfocus.com/bid/70384
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96933
• https://service.sap.com/sap/support/notes/1908531Vendor Advisory

Published

Oct 16, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-8310The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 al…
• CVE-2014-8311SAP BusinessObjects Edge 4.0 allows remote attackers to obta…
• CVE-2014-8312Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows…
• CVE-2014-8313Eval injection in ide/core/base/server/net.xsjs in the Devel…
• CVE-2014-8314Multiple cross-site scripting (XSS) vulnerabilities in SAP H…
• CVE-2014-8315polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 buil…
• CVE-2014-8317Cross-site scripting (XSS) vulnerability in the Webform Vali…
• CVE-2014-8318Cross-site scripting (XSS) vulnerability in the Webform modu…
• CVE-2014-8319Cross-site scripting (XSS) vulnerability in the easy_social_…
• CVE-2014-8320Cross-site scripting (XSS) vulnerability in the Custom Searc…
• CVE-2014-8321Stack-based buffer overflow in the gps_tracker function in a…7.8
• CVE-2014-8322Stack-based buffer overflow in the tcp_test function in aire…9.8