100 matches found
CVE-2014-7296
The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURESECUREPROCESSING, which allows remote authenticated users to execute arbitrary Java code via a crafted XSL document...
Default configuration
The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURESECUREPROCESSING, which allows remote authenticated users to execute arbitrary Java code via a crafted XSL document...
CVE-2014-7296
CVE-2014-7296 affects SpagoBI 5.0.0: the accessibility engine’s default config does not enable FEATURE_SECURE_PROCESSING, allowing remote authenticated users to execute arbitrary Java code through a crafted XSL document. Impact is code execution with partial confidentiality/integrity/availability...
CVE-2014-7296
The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURESECUREPROCESSING, which allows remote authenticated users to execute arbitrary Java code via a crafted XSL document...
SpagoBI 4.0 - Arbitrary XSS File Upload
No description provided by source. 01. Advisory Information Title: XSS File Upload Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02. Vulnerability Information CVE reference: CVE-2013-6234 CVSS v2...
SpagoBI 4.0 - Privilege Escalation Vulnerability
No description provided by source. 01. Advisory Information Title: Remote Privilege Escalation in SpagoBI Date published: 2013-02-28 Date of last update: 2013-02-28 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Information CVE reference:...
SpagoBI 4.0 - Persistent HTML Script Insertion
No description provided by source. 01. Advisory Information Title: Persistent HTML Script Insertion permits offsite-bound forms Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02. Vulnerability...
SpagoBI 4.0 - Persistent XSS Vulnerability
No description provided by source. 01. Advisory Information Title: Persistent Cross-Site Scripting XSS in SpagoBI Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Information CVE...
[CVE-2013-6232] Persistent Cross-Site Scripting (XSS) in SpagoBI v4.0
Advisory Information Title: Persistent Cross-Site Scripting XSS in SpagoBI Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Information CVE reference: CVE-2013-6232 CVSS v2 Base...
[CVE-2013-6233] Persistent HTML Script Insertion permits offsite-bound forms in SpagoBI v4.0
Advisory Information Title: Persistent HTML Script Insertion permits offsite-bound forms Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02. Vulnerability Information CVE reference: CVE-2013-6233...
[CVE-2013-6231] Remote Privilege Escalation in SpagoBI v4.0
Advisory Information Title: Remote Privilege Escalation in SpagoBI Date published: 2013-02-28 Date of last update: 2013-02-28 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Information CVE reference: CVE-2013-6231 CVSS v2 Base Score: 9...
[CVE-2013-6234] XSS File Upload in SpagoBI v4.0
Advisory Information Title: XSS File Upload Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02. Vulnerability Information CVE reference: CVE-2013-6234 CVSS v2 Base Score: 4 CVSS v2 Vector:...
CVE-2013-6233
Cross-site scripting XSS vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field in the "Short document metadata."...
CVE-2013-6232
Cross-site scripting XSS vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via a document note in the execution page...
Cross site scripting
Cross-site scripting XSS vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field in the "Short document metadata."...
Cross site scripting
Cross-site scripting XSS vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via a document note in the execution page...
CVE-2013-6233
Cross-site scripting XSS vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field in the "Short document metadata."...
CVE-2013-6232
Cross-site scripting XSS vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via a document note in the execution page...
CVE-2013-6232
CVE-2013-6232 corresponds to a persistent XSS in SpagoBI prior to v4.1. The vulnerability allows a restricted, authenticated user to insert a malicious note in the execution page, which can execute script when viewed by another user. Exploitation described as inserting a note containing javascrip...
CVE-2013-6233
CVE-2013-6233 affects SpagoBI (Open Source BI suite). The vulnerability is a cross-site scripting (XSS) flaw in the input handling of the Description field in the Short document metadata, allowing remote attackers with authentication to inject arbitrary HTML/script. Technical description and advi...