CVE-2014-7296: Improper Control of Generation of Code

The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURESECUREPROCESSING, which allows remote authenticated users to execute arbitrary Java code via a crafted XSL document...

PT-2014-7888

Name of the Vulnerable Software and Affected Versions SpagoBI version 5.0.0 Description The issue concerns the accessibility engine in SpagoBI, where the default configuration does not set FEATURE SECURE PROCESSING. This allows remote authenticated users to execute arbitrary Java code via a craft...