PT-2022-8655

Name of the Vulnerable Software and Affected Versions MicroStrategy Web SDK versions 10.11 and earlier Description The issue allows remote unauthenticated attackers to execute arbitrary code. This is achieved via the fileToUpload parameter to the uploadFile task. Recommendations For MicroStrategy...

PT-2022-8652

Name of the Vulnerable Software and Affected Versions MicroStrategy Web SDK versions 10.11 and earlier Description The issue allows remote unauthenticated attackers to execute arbitrary code via the key parameter to the getGoogleExtraConfig task. This is a Cross-Site Scripting XSS issue...

PT-2022-8653

Name of the Vulnerable Software and Affected Versions MicroStrategy Web SDK versions 10.11 and earlier Description The issue allows remote unauthenticated attackers to execute arbitrary code via the key parameter to the getESRIExtraConfig task. This is a Cross-Site Scripting XSS issue...

MicroStrategy Web SDK 跨站脚本漏洞

MicroStrategy Web SDK is a JavaScript library from MicroStrategy, Inc. It interacts with different CARTO APIs to build custom applications on top of deck.gl that utilize vector rendering. MicroStrategy Web SDK version 10.11 and earlier versions contain a cross-site scripting vulnerability that...

MicroStrategy Web SDK 跨站脚本漏洞

The MicroStrategy Web SDK is a JavaScript library from MicroStrategy, Inc. Interact with different CARTO APIs to build custom applications that utilize vector rendering on top of deck.gl. A cross-site scripting vulnerability exists in MicroStrategy Web SDK version 10.11 and prior versions, which...

MicroStrategy Web SDK 跨站脚本漏洞

The MicroStrategy Web SDK is a JavaScript library from MicroStrategy, Inc. Interact with different CARTO APIs to build custom applications that utilize vector rendering on top of deck.gl. A cross-site scripting vulnerability exists in MicroStrategy Web SDK 10.11 and prior versions, which stems fr...

MicroStrategy Web SDK 跨站脚本漏洞

MicroStrategy Web SDK is a JavaScript library from MicroStrategy, Inc. Interacts with different CARTO APIs to build custom applications that utilize vector rendering on top of deck.gl. A cross-site scripting vulnerability exists in MicroStrategy Web SDK 10.11 and prior versions, which stems from ...

CVE-2020-22984: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via key parameter to the getGoogleExtraConfig task...

CVE-2020-22985: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the key parameter to the getESRIExtraConfig task...

CVE-2020-22987: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the fileToUpload parameter to the uploadFile task...

PT-2022-8654

Name of the Vulnerable Software and Affected Versions MicroStrategy Web SDK versions 10.11 and earlier Description The issue allows remote unauthenticated attackers to execute arbitrary code via the searchString parameter to the wikiScrapper task. This is a Cross-Site Scripting XSS issue...

CVE-2020-22986: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the searchString parameter to the wikiScrapper task...

MicroStrategy Web Cross-Site Scripting Vulnerability (CNVD-2020-23180)

Microstrategy Web is a set of U.S. Microstrategy's enterprise data analysis platform. The platform features data discovery, data visualization and report generation. A cross-site scripting vulnerability exists in the HTML Container and Insert Text features in Microstrategy Web version 10.4. The...

Microstrategy Web Information Disclosure Vulnerability

Microstrategy Web is a set of U.S. Microstrategy's enterprise data analysis platform. The platform features data discovery, data visualization and report generation. A security vulnerability exists in Microstrategy Web version 10.4. An attacker could exploit the vulnerability to obtain informatio...

Microstrategy Web Code Issue Vulnerability (CNVD-2020-23179)

Microstrategy Web is a set of U.S. Microstrategy's enterprise data analysis platform. The platform features data discovery, data visualization and report generation. A security vulnerability exists in the Upload Visualization plug-in for the administrator panel in Microstrategy Web version 10.4. ...

Microstrategy Web Code Issue Vulnerability (CNVD-2020-23183)

Microstrategy Web is a set of U.S. Microstrategy's enterprise data analysis platform. The platform features data discovery, data visualization and report generation. A code issue vulnerability exists in Microstrategy Web version 10.4. The vulnerability arises from an improperly designed or...

Microstrategy Web Code Issue Vulnerability

Microstrategy Web is a set of U.S. Microstrategy's enterprise data analysis platform. The platform features data discovery, data visualization and report generation. A code issue vulnerability exists in Microstrategy Web version 10.4. The vulnerability arises from an improperly designed or...

CVE-2020-11452

Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resources aka SSRF or leak files from the local system using the...

CVE-2020-11453

Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parameters in the SSRF request, it is still possible to exploit ...

CVE-2020-11453

Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parameters in the SSRF request, it is still possible to exploit ...