CVE-2018-12355

Knowage formerly SpagoBI 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue...

CVE-2018-12355

CVE-2018-12355 affects Knowage (formerly SpagoBI) 6.1.1 with a cross-site scripting vulnerability in the Olap Schemas’ Catalogue exposed via the name or description fields. Multiple sources corroborate an XSS in Knowage 6.1.1; the vulnerability enables injection of arbitrary scripts through the s...

CVE-2018-12354

Knowage (formerly SpagoBI) 6.1.1 is documented as vulnerable to cross-site request forgery (CSRF) via every form, demonstrated by a POST to /knowage/restful-services/2.0/analyticalDrivers/. CVE-2018-12354 is assessed with CVSS v3.0 base score 8.8 (HIGH) and CVSS v2.0 base score 6.8 (MEDIUM) indic...

CVE-2018-12354

Knowage formerly SpagoBI 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request...

CVE-2018-12355

Knowage formerly SpagoBI 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue...

CVE-2018-12353

Knowage formerly SpagoBI 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue...

CVE-2018-12353

Knowage (formerly SpagoBI) 6.1.1 is affected by a Cross-Site Scripting (XSS) vulnerability in the name field of the Business Model’s Catalogue, leading to script injection in the catalogue view. The issue is documented as CVE-2018-12353 with public references indicating XSS via the name field and...