https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-6208.htmlhttps://patchthecve.com/cve/CVE-2020-6208.htmlWed, 17 Jun 2026 03:22:52 +0000HIGH 8.2: SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application, leading to Remote Code Execution. https://patchthecve.com/cve/CVE-2019-0285.htmlhttps://patchthecve.com/cve/CVE-2019-0285.htmlWed, 17 Jun 2026 02:08:08 +0000CRITICAL 9.8: The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.https://patchthecve.com/cve/CVE-2018-2427.htmlhttps://patchthecve.com/cve/CVE-2018-2427.htmlWed, 17 Jun 2026 01:55:40 +0000HIGH 8.8: SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 2010) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.https://patchthecve.com/cve/CVE-2014-5506.htmlhttps://patchthecve.com/cve/CVE-2014-5506.htmlWed, 17 Jun 2026 00:11:38 +0000MEDIUM 6.8: Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file.https://patchthecve.com/cve/CVE-2014-5505.htmlhttps://patchthecve.com/cve/CVE-2014-5505.htmlWed, 17 Jun 2026 00:11:37 +0000MEDIUM 6.8: Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an RPT file.https://patchthecve.com/cve/CVE-2010-2590.htmlhttps://patchthecve.com/cve/CVE-2010-2590.htmlTue, 16 Jun 2026 23:21:02 +0000HIGH 9.3: Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix Pack 3.2 allows remote attackers to execute arbitrary code via a long ServerResourceVersion property value.https://patchthecve.com/cve/CVE-2010-3032.htmlhttps://patchthecve.com/cve/CVE-2010-3032.htmlTue, 16 Jun 2026 23:22:00 +0000HIGH 10.0: Integer overflow in the OBGIOPServerWorker::extractHeader function in the ebus-3-3-2-6.dll module in SAP Crystal Reports 2008 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a GIOP packet with a crafted size, which triggers a heap-based buffer ovehttps://patchthecve.com/cve/CVE-2004-0204.htmlhttps://patchthecve.com/cve/CVE-2004-0204.htmlTue, 16 Jun 2026 22:05:09 +0000HIGH 7.5: Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to https://patchthecve.com/cve/CVE-2004-1981.htmlhttps://patchthecve.com/cve/CVE-2004-1981.htmlTue, 16 Jun 2026 22:08:46 +0000MEDIUM 5.0: The web interface for Crystal Reports allows remote attackers to cause a denial of service (disk exhaustion) by repeatedly requesting reports without retrieving the associated image files, which are not cleared from the image file folder.https://patchthecve.com/cve/CVE-2001-1464.htmlhttps://patchthecve.com/cve/CVE-2001-1464.htmlTue, 16 Jun 2026 21:56:19 +0000HIGH 7.5: Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers to obtain passwords.