Filtered by vendor Eng
Subscriptions
Total
23 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2013-6232 | 1 Eng | 1 Spagobi | 2024-08-06 | N/A |
| Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via a document note in the execution page. | ||||
| CVE-2013-6234 | 1 Eng | 1 Spagobi | 2024-08-06 | 8.0 High |
| Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, aka "XSS File Upload." | ||||
| CVE-2013-6233 | 1 Eng | 1 Spagobi | 2024-08-06 | N/A |
| Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field in the "Short document metadata." | ||||
| CVE-2013-6231 | 1 Eng | 1 Spagobi | 2024-08-06 | 8.8 High |
| SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script | ||||
| CVE-2014-7296 | 1 Eng | 1 Spagobi | 2024-08-06 | N/A |
| The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURE_SECURE_PROCESSING, which allows remote authenticated users to execute arbitrary Java code via a crafted XSL document. | ||||
| CVE-2018-12355 | 1 Eng | 1 Knowage | 2024-08-05 | 6.1 Medium |
| Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue. | ||||
| CVE-2019-13348 | 1 Eng | 1 Knowage | 2024-08-04 | N/A |
| In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases. | ||||
| CVE-2019-13188 | 1 Eng | 1 Knowage | 2024-08-04 | N/A |
| In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application. | ||||
| CVE-2019-13189 | 1 Eng | 1 Knowage | 2024-08-04 | N/A |
| In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page. | ||||
| CVE-2019-13190 | 1 Eng | 1 Knowage | 2024-08-04 | N/A |
| In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page. | ||||
| CVE-2021-30211 | 1 Eng | 1 Knowage | 2024-08-03 | 5.4 Medium |
| Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter. | ||||
| CVE-2021-30213 | 1 Eng | 1 Knowage | 2024-08-03 | 6.1 Medium |
| Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter. | ||||
| CVE-2021-30058 | 1 Eng | 1 Knowage | 2024-08-03 | 6.1 Medium |
| Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBI_HOST' parameter. | ||||
| CVE-2021-30212 | 1 Eng | 1 Knowage | 2024-08-03 | 5.4 Medium |
| Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter. | ||||
| CVE-2021-30214 | 1 Eng | 1 Knowage | 2024-08-03 | 5.4 Medium |
| Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter. | ||||
| CVE-2021-30055 | 1 Eng | 1 Knowage | 2024-08-03 | 8.8 High |
| A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report. | ||||
| CVE-2021-30057 | 1 Eng | 1 Knowage | 2024-08-03 | 4.8 Medium |
| A stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject arbitrary HTML in "/restful-services/2.0/analyticalDrivers" via the 'LABEL' and 'NAME' parameters. | ||||
| CVE-2021-30056 | 1 Eng | 1 Knowage | 2024-08-03 | 5.4 Medium |
| Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage. | ||||
| CVE-2022-39295 | 1 Eng | 1 Knowage | 2024-08-03 | 6.1 Medium |
| Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the `XSSRequestWrapper::stripXSS` method can be bypassed. Versions 7.4.22, 8.0.9, and 8.1.0 contain patches for this issue. There are no known workarounds. | ||||
| CVE-2023-38702 | 1 Eng | 1 Knowage | 2024-08-02 | 10 Critical |
| Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-services/dossier/importTemplateFile` allows authenticated users to upload `template file` on the server, but does not need any authorization to be reached. When the JSP file is uploaded, the attacker just needs to connect to `/knowageqbeengine/foo.jsp` to gain code execution on the server. By exploiting this vulnerability, an attacker with low privileges can upload a JSP file to the `knowageqbeengine` directory and gain code execution capability on the server. This issue has been patched in Knowage version 8.1.8. | ||||