CVE-2019-13189

In Knowage through 6.1.1, there is XSS via the starturl or userid field to the ChangePwdServlet page...

CVE-2019-13348

In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases...

CVE-2019-13189

In Knowage through 6.1.1, there is XSS via the starturl or userid field to the ChangePwdServlet page...

Code injection

In Knowage through 6.1.1, there is XSS via the starturl or userid field to the ChangePwdServlet page...

Design/Logic Flaw

In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases...

CVE-2019-13348

CVE-2019-13348 affects Knowage up to 6.1.1: an authenticated user who visits the datasources page can access data source credentials in cleartext (including database credentials). Multiple connected sources corroborate this vulnerability (NVD entry, Red Hat advisory, CNVD, OSV, CVE listings). Roo...

CVE-2019-13348

In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases...

CVE-2019-13189

In Knowage through 6.1.1, there is XSS via the starturl or userid field to the ChangePwdServlet page...

CVE-2019-13189

Knowage up to version 6.1.1 is vulnerable to a Cross-Site Scripting (XSS) flaw that can be triggered via the start_url or user_id parameter targeting the ChangePwdServlet. The issue stems from insufficient validation of client-side data, enabling an attacker to inject and execute script in the us...

Knowage Cross-Site Scripting Vulnerability (CNVD-2018-11813)

Knowage formerly SpagoBI is an open source suite for modern business analytics on traditional resources and big data systems from Knowage Italy. A cross-site scripting vulnerability exists in Knowage version 6.1.1. A remote attacker can exploit the vulnerability by sending the name or description...

Knowage Cross-Site Scripting Vulnerability

Knowage formerly SpagoBI is an open source suite for modern business analytics on traditional resources and big data systems from Knowage Italy. A cross-site scripting vulnerability exists in Knowage version 6.1.1. A remote attacker can exploit the vulnerability by sending the name field to the...

Knowage Cross-Site Request Forgery Vulnerability

Knowage formerly SpagoBI is an open source suite for modern business analytics on traditional resources and big data systems from Knowage Italy. A cross-site request forgery vulnerability exists in Knowage 6.1.1. A remote attacker can exploit this vulnerability with the help of a form to send a...

Cross site scripting

Knowage formerly SpagoBI 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue...

CVE-2018-12353

Knowage formerly SpagoBI 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue...

Cross site scripting

Knowage formerly SpagoBI 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue...

CVE-2018-12355

Knowage formerly SpagoBI 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue...

CVE-2018-12354

Knowage formerly SpagoBI 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request...

CVE-2018-12353

Knowage formerly SpagoBI 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue...

Cross site request forgery (csrf)

Knowage formerly SpagoBI 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request...

CVE-2018-12354

Knowage formerly SpagoBI 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request...