Improper access control

Incorrect Access Control issue in Yellowfin Business Intelligence 7.3 allows remote attackers to escalate privilege via MIAdminStyles.i4 Admin UI...

Cross site scripting

Cross Site Scripting XSS vulnerability in configMap parameters in Yellowfin Business Intelligence 7.3 allows remote attackers to run arbitrary code via MIAdminStyles.i4 Admin UI...

CVE-2020-19587

CVE-2020-19587 denotes a Cross Site Scripting (XSS) vulnerability in Yellowfin Business Intelligence 7.3, originating from configMap parameters exposed via the MIAdminStyles.i4 Admin UI. The issue enables a remote attacker to run arbitrary code and has a CVSS v3.1 base score of 5.4 (Medium) with ...

CVE-2020-19587

Cross Site Scripting XSS vulnerability in configMap parameters in Yellowfin Business Intelligence 7.3 allows remote attackers to run arbitrary code via MIAdminStyles.i4 Admin UI...

CVE-2020-19586

Incorrect Access Control issue in Yellowfin Business Intelligence 7.3 allows remote attackers to escalate privilege via MIAdminStyles.i4 Admin UI...

CVE-2020-19586

CVE-2020-19586 affects Yellowfin Business Intelligence 7.3, specifically an incorrect access control in the MIAdminStyles.i4 Admin UI that enables remote privilege escalation. The issue is tied to how privileges are enforced in the Admin UI, allowing an attacker to escalate rights. Documented in ...

Yellowfin 跨站脚本漏洞

Yellowfin is a suite of innovative data and analytics products from Yellowfin Australia. A security vulnerability exists in Yellowfin Business Intelligence version 7.3, which stems from a cross-site scripting XSS vulnerability found to be contained in the configMap parameter. An attacker could...

PT-2022-8602 · Yellowfin · Yellowfin Business Intelligence

Name of the Vulnerable Software and Affected Versions: Yellowfin Business Intelligence version 7.3 Description: The issue is related to a Cross Site Scripting XSS vulnerability in configMap parameters. This allows remote attackers to run arbitrary code via the MIAdminStyles.i4 Admin UI...

PT-2022-8601 · Yellowfin · Yellowfin Business Intelligence

Name of the Vulnerable Software and Affected Versions: Yellowfin Business Intelligence version 7.3 Description: The issue is related to Incorrect Access Control, allowing remote attackers to escalate privileges via the MIAdminStyles.i4 Admin UI. Recommendations: For Yellowfin Business Intelligenc...

Yellowfin 跨站脚本漏洞

Yellowfin is a suite of innovative data and analytics products from Yellowfin Australia. A security vulnerability exists in Yellowfin Business Intelligence version 7.3 that stems from incorrect access control. An attacker could exploit the vulnerability to escalate privileges via MIAdminStyles.i4...

Yellowfin Insecure Direct Object Reference Vulnerability (CNVD-2021-99268)

An insecure direct object reference vulnerability exists in versions of Yellowfin prior to 9.6.1, a business intelligence automated analytics, cross-vendor narrative and collaboration software suite. An attacker could exploit the vulnerability by sending a specially crafted HTTP GET request to th...

Yellowfin insecure direct object reference vulnerability

An insecure direct object reference vulnerability exists in versions of Yellowfin prior to 9.6.1, a business intelligence automated analytics, cross-vendor narrative and collaboration software suite. An attacker could exploit the vulnerability by sending a specially crafted HTTP GET request to th...

Yellowfin Cross-Site Scripting Vulnerability

Yellowfin is a business intelligence automated analytics, cross-vendor narrative and collaboration software suite. A stored cross-site scripting vulnerability exists in the video embedding feature in Yellowfin versions prior to 9.6.1. An attacker can exploit this vulnerability by sending a...

CVE-2021-36388

In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4"...

CVE-2021-36388

In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4"...

CVE-2021-36389

In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4"...

CVE-2021-36387

In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4"...

CVE-2021-36389

In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4"...

CVE-2021-36387

In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4"...

CVE-2021-36387

In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4"...