CVE-2018-12354

Knowage (formerly SpagoBI) 6.1.1 is documented as vulnerable to cross-site request forgery (CSRF) via every form, demonstrated by a POST to /knowage/restful-services/2.0/analyticalDrivers/. CVE-2018-12354 is assessed with CVSS v3.0 base score 8.8 (HIGH) and CVSS v2.0 base score 6.8 (MEDIUM) indic...

CVE-2018-12353

Knowage (formerly SpagoBI) 6.1.1 is affected by a Cross-Site Scripting (XSS) vulnerability in the name field of the Business Model’s Catalogue, leading to script injection in the catalogue view. The issue is documented as CVE-2018-12353 with public references indicating XSS via the name field and...

PT-2018-11140

Name of the Vulnerable Software and Affected Versions Knowage formerly SpagoBI version 6.1.1 Description The issue allows for XSS attacks through the name or description field in the "Olap Schemas' Catalogue" catalogue. Recommendations For Knowage formerly SpagoBI version 6.1.1, consider...

CVE-2018-12354: Cross-Site Request Forgery (CSRF)

Knowage formerly SpagoBI 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request...

CVE-2018-12355: Improper Neutralization of Input During Web Page Generation

Knowage formerly SpagoBI 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue...

CVE-2018-12353: Improper Neutralization of Input During Web Page Generation

Knowage formerly SpagoBI 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue...

PT-2018-11138

Name of the Vulnerable Software and Affected Versions Knowage formerly SpagoBI version 6.1.1 Description The issue allows for XSS via the name field to the "Business Model's Catalogue" catalogue. Recommendations For Knowage formerly SpagoBI version 6.1.1, consider restricting access to the...

PT-2018-11139

Name of the Vulnerable Software and Affected Versions Knowage formerly SpagoBI version 6.1.1 Description The issue allows for CSRF via every form. This can be demonstrated by a POST request to the "knowage/restful-services/2.0/analyticalDrivers/" endpoint. Recommendations For Knowage formerly...