PT-2026-121796

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy...

KNIME Server / Business Hub WebPortal - Detect

KNIME Server and its successor KNIME Business Hub, a commercial platform from KNIME AG for deploying, executing, and managing data-science and machine learning workflows built in the KNIME Analytics Platform, was detected. An exposed WebPortal login page was identified, including...

EUVD-2022-47680

Malicious code in bioql PyPI...

EUVD-2021-31888

Malicious code in bioql PyPI...

EUVD-2021-31541

Malicious code in bioql PyPI...

EUVD-2021-31540

Malicious code in bioql PyPI...

CVE-2021-44725

KNIME Server before 4.13.4 allows directory traversal in a request for a client profile...

CVE-2021-44726

KNIME Server before 4.13.4 allows XSS via the old WebPortal login page...

Cross site scripting

An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by...

CVE-2023-5562 Unsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business Hub

An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by...

Knime Analytics Platform Cross-Site Scripting Vulnerability

Knime Analytics Platform is a free and open source data analytics, reporting and integration platform from Knime, Switzerland. A cross-site scripting vulnerability exists in KNIME Analytics Platform versions prior to 5.2.0, which arises from insecure default settings that allow cross-site scripti...

CVE-2023-5562: Improper Neutralization of Input During Web Page Generation

An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by...

CVE-2022-44748

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when being uploaded, ca...

CVE-2022-44748

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when being uploaded, ca...

Directory traversal

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when being uploaded, ca...

CVE-2022-44748 Uploading workflows to KNIME Server may override arbitrary file system contents

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when being uploaded, ca...

CVE-2022-44748 Uploading workflows to KNIME Server may override arbitrary file system contents

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when being uploaded, ca...

CVE-2022-44748

CVE-2022-44748 - KNIME Server Zip-Slip directory traversal . A vulnerability in KNIME Server’s ZIP archive extraction routines allows an authenticated user (with upload rights) to overwrite arbitrary files on the server’s filesystem. The root cause is directory traversal during workflow upload, e...

CVE-2022-44748: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when being uploaded, ca...

PT-2022-27298 · Knime · Knime Server

Name of the Vulnerable Software and Affected Versions: KNIME Server versions 4.3.0 through 4.13.5 KNIME Server versions 4.14.0 through 4.14.2 KNIME Server versions 4.15.0 through 4.15.2 Description: A directory traversal vulnerability in the ZIP archive extraction routines can result in arbitrary...