CVE-2019-13189: Improper Neutralization of Input During Web Page Generation

In Knowage through 6.1.1, there is XSS via the starturl or userid field to the ChangePwdServlet page...

PT-2019-13178

Name of the Vulnerable Software and Affected Versions Knowage versions prior to 6.1.2 Description The issue allows for XSS via the start url or user id field to the "ChangePwdServlet" page. Recommendations For versions prior to 6.1.2, update to version 6.1.2 or later to resolve the issue...

CVE-2019-13348: Insufficiently Protected Credentials

In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases...

PT-2019-13282

Name of the Vulnerable Software and Affected Versions Knowage versions prior to 6.1.2 Description The issue allows an authenticated user who accesses the datasources page to gain access to any data source credentials in cleartext, including databases. Recommendations For versions prior to 6.1.2,...

Knowage Cross-Site Scripting Vulnerability (CNVD-2018-11813)

Knowage formerly SpagoBI is an open source suite for modern business analytics on traditional resources and big data systems from Knowage Italy. A cross-site scripting vulnerability exists in Knowage version 6.1.1. A remote attacker can exploit the vulnerability by sending the name or description...

Knowage Cross-Site Request Forgery Vulnerability

Knowage formerly SpagoBI is an open source suite for modern business analytics on traditional resources and big data systems from Knowage Italy. A cross-site request forgery vulnerability exists in Knowage 6.1.1. A remote attacker can exploit this vulnerability with the help of a form to send a...

Knowage Cross-Site Scripting Vulnerability

Knowage formerly SpagoBI is an open source suite for modern business analytics on traditional resources and big data systems from Knowage Italy. A cross-site scripting vulnerability exists in Knowage version 6.1.1. A remote attacker can exploit the vulnerability by sending the name field to the...

CVE-2018-12355

Knowage formerly SpagoBI 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue...

Cross site request forgery (csrf)

Knowage formerly SpagoBI 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request...

Cross site scripting

Knowage formerly SpagoBI 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue...

CVE-2018-12353

Knowage formerly SpagoBI 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue...

CVE-2018-12353

Knowage formerly SpagoBI 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue...

CVE-2018-12354

Knowage formerly SpagoBI 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request...

CVE-2018-12355

Knowage formerly SpagoBI 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue...

CVE-2018-12354

Knowage formerly SpagoBI 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request...

Cross site scripting

Knowage formerly SpagoBI 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue...

CVE-2018-12353

Knowage formerly SpagoBI 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue...

CVE-2018-12354

Knowage formerly SpagoBI 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request...

CVE-2018-12355

Knowage formerly SpagoBI 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue...

CVE-2018-12355

CVE-2018-12355 affects Knowage (formerly SpagoBI) 6.1.1 with a cross-site scripting vulnerability in the Olap Schemas’ Catalogue exposed via the name or description fields. Multiple sources corroborate an XSS in Knowage 6.1.1; the vulnerability enables injection of arbitrary scripts through the s...