229 matches found
CVE-2021-30055
A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'paryear' parameter when running a report...
CVE-2021-30055
CVE-2021-30055 is a SQL injection vulnerability in Knowage Suite 7.1, affecting the documentexecution/url analytics driver via the par_year parameter when generating a report. Root cause: improper handling of input in the URL analytics driver leading to SQL commands being injected. Impact: potent...
CVE-2021-30056
Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting XSS. An attacker can inject arbitrary web script in /restful-services/publish via the 'EXECFROM' parameter that can lead to data leakage...
CVE-2021-30056
CVE-2021-30056 affects Knowage Suite prior to 7.4, where a reflected XSS vulnerability exists in the /restful-services/publish endpoint via the EXEC_FROM parameter, potentially leading to data leakage. The issue is documented across multiple feeds (NVD/Red Hat/CNVD/etc.). Mitigation is to upgrade...
CVE-2021-30057
CVE-2021-30057 is a stored HTML injection vulnerability in Knowage Suite (v7.1). An attacker can inject arbitrary HTML into the endpoint /restful-services/2.0/analyticalDrivers by manipulating the LABEL and NAME parameters. Public references in multiple feeds corroborate a vulnerability in Knowag...
CVE-2021-30057
A stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject arbitrary HTML in "/restful-services/2.0/analyticalDrivers" via the 'LABEL' and 'NAME' parameters...
CVE-2021-30058
CVE-2021-30058 affects Knowage Suite prior to 7.4. The vulnerability is a cross-site scripting (XSS) flaw that allows an attacker to inject arbitrary external scripts via the SBI_HOST parameter in the request to /knowagecockpitengine/api/1.0/pages/execute. Impact is described as enabling injectio...
CVE-2021-30058
Knowage Suite before 7.4 is vulnerable to cross-site scripting XSS. An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBIHOST' parameter...
Knowage 跨站脚本漏洞
Knowage is a suite of open source tools for modern business analytics. A cross-site scripting vulnerability exists in Knowage versions prior to 7.4, which can be exploited by an attacker to inject arbitrary external scripts in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBIHOST'...
Knowage SQL注入漏洞
Knowage is a suite of open source tools for modern business analytics. A SQL injection vulnerability exists in the documentexecution/url analysis driver component of Knowage prior to version 7.4 when running reports. An attacker can exploit this vulnerability to execute arbitrary SQL commands on ...
Knowage 跨站脚本漏洞
Knowage is a suite of open source tools for modern business analytics. A reflective cross-site scripting vulnerability exists in Knowage versions prior to 7.4. The vulnerability can be exploited to inject arbitrary external scripts into /restful-services/publish via the 'EXECFROM' parameter, whic...
Knowage 注入漏洞
Knowage is a suite of open source tools for modern business analytics. An HTML injection vulnerability exists in Knowage versions prior to 7.4. The vulnerability can be exploited to inject arbitrary HTML into "/restful-services/2.0/analyticalDrivers" via the 'LABEL' and 'NAME' parameters...
Knowage Access Control Bypass Vulnerability
Knowage is a suite of open source tools for modern business analytics. An access control bypass vulnerability exists in Knowage 6.1.1 and earlier versions. An attacker can exploit this vulnerability to bypass access control and gain access to the entire application...
Knowage Username Enumeration Vulnerability
Knowage is an open source suite for modern business analytics on traditional resources and big data systems from Knowage Italy. A security vulnerability exists in Knowage 6.1.1 and earlier versions. An attacker could exploit the vulnerability to enumerate valid usernames...
Knowage CAPTCHA Bypass Vulnerability
Knowage is a suite of open source tools for modern business analytics. A CAPTCHA bypass vulnerability exists in Knowage 6.1.1 and earlier versions. The vulnerability stems from the registration page not invalidating a valid CAPTCHA token. An attacker can exploit this vulnerability to bypass CAPTC...
Knowage Trust Management Issues Vulnerabilities
Knowage is a suite of open source tools for modern business analytics. A security vulnerability exists in Knowage 6.1.1 and earlier versions. An attacker can exploit the vulnerability to obtain all user password hashes...
CVE-2019-14278
In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page...
CVE-2019-14278
In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page...