CVE-2020-22984

The CVE-2020-22984 entry concerns a Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier. The root cause is lack of filtering/escaping of the getGoogleExtraConfig parameter, allowing remote unauthenticated attackers to execute arbitrary code via the key parameter. A...

CVE-2020-22987: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the fileToUpload parameter to the uploadFile task...

MicroStrategy Web SDK 跨站脚本漏洞

MicroStrategy Web SDK is a JavaScript library from MicroStrategy, Inc. Interacts with different CARTO APIs to build custom applications that utilize vector rendering on top of deck.gl. A cross-site scripting vulnerability exists in MicroStrategy Web SDK 10.11 and prior versions, which stems from ...

CVE-2020-22984: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via key parameter to the getGoogleExtraConfig task...

MicroStrategy Web SDK 跨站脚本漏洞

The MicroStrategy Web SDK is a JavaScript library from MicroStrategy, Inc. Interact with different CARTO APIs to build custom applications that utilize vector rendering on top of deck.gl. A cross-site scripting vulnerability exists in MicroStrategy Web SDK 10.11 and prior versions, which stems fr...

MicroStrategy Web SDK 跨站脚本漏洞

The MicroStrategy Web SDK is a JavaScript library from MicroStrategy, Inc. Interact with different CARTO APIs to build custom applications that utilize vector rendering on top of deck.gl. A cross-site scripting vulnerability exists in MicroStrategy Web SDK version 10.11 and prior versions, which...

MicroStrategy Web SDK 跨站脚本漏洞

MicroStrategy Web SDK is a JavaScript library from MicroStrategy, Inc. It interacts with different CARTO APIs to build custom applications on top of deck.gl that utilize vector rendering. MicroStrategy Web SDK version 10.11 and earlier versions contain a cross-site scripting vulnerability that...

CVE-2020-22986: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the searchString parameter to the wikiScrapper task...

CVE-2020-22985: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the key parameter to the getESRIExtraConfig task...

CVE-2022-29596

MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=anypassword&ConnMode=1&3054=Login substring for directory traversal...

CVE-2022-29596

MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=anypassword&ConnMode=1&3054=Login substring for directory traversal...

CVE-2022-29596

MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=anypassword&ConnMode=1&3054=Login substring for directory traversal...

Directory traversal

MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=anypassword&ConnMode=1&3054=Login substring for directory traversal...

CVE-2022-29596

MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=anypassword&ConnMode=1&3054=Login substring for directory traversal...

CVE-2022-29596

CVE-2022-29596 affects MicroStrategy Enterprise Manager 2022. An authentication bypass arises by triggering a login failure and submitting the substring Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=any_password &ConnMode=1&3054=Login, enabling directory traversal. Public refer...

CVE-2022-29596: Improper Limitation of a Pathname to a Restricted Directory

MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=anypassword&ConnMode=1&3054=Login substring for directory traversal...

MicroStrategy Enterprise Manager 路径遍历漏洞

MicroStrategy Enterprise Manager is a tool from MicroStrategy, Inc. that provides reports and dashboards. It displays statistics on the usage of MicroStrategy software. A security vulnerability exists in MicroStrategy Enterprise Manager, which can be exploited by an attacker to bypass...

PT-2022-19716 · Microstrategy · Microstrategy Enterprise Manager

Name of the Vulnerable Software and Affected Versions: MicroStrategy Enterprise Manager version 2022 Description: The issue allows authentication bypass by triggering a login failure and then entering a specific substring for directory traversal. This can be achieved by entering...

MicroStrategy Cross-Site Request Forgery Vulnerability

Microstrategy is a suite of business analytics and mobility platforms from US-based Microstrategy. MicroStrategy version 10.4 suffers from a cross-site request forgery vulnerability that could allow an authenticated user to access the content of an internal web resource or leak files from a local...

CVE-2020-24815

A Server-Side Request Forgery SSRF affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the local system via HTML containers embedded in a...