SpagoBI任意文件上传漏洞

BUGTRAQ ID: 65488 CVECAN ID: CVE-2013-6234 SpagoBI是开源的商业智能软件包。 SpagoBI 4.0及其他版本没有限制从Worksheet设计器功能上传特定文件类型，这可使远程攻击者上传任意文件。 0 SpagoBI SpagoBI 4.0 厂商补丁： SpagoBI ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： www.spagoworld.org http://forge.ow2.org/project/showfiles.php?groupid=204 !DOCTYPE html html hea...

SpagoBI远程权限提升漏洞

BUGTRAQ ID: 65925 CVECAN ID: CVE-2013-6231 SpagoBI是开源的商业智能软件包。 SpagoBI 4.0及其他版本的服务程序AdapterHTTP?ACTIONNAME=MANAGEUSERACTION由特制输入执行时会触发权限提升漏洞，该漏洞可使远程攻击者获取管理员权限。 0 SpagoBI SpagoBI 4.0 厂商补丁： SpagoBI ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： www.spagoworld.org...

SpagoBI HTML注入漏洞

Bugtraq ID:65911 CVE ID:CVE-2013-6232 SpagoBI提供一个基于J2EE的框架用于管理BI对象如报表、OLAP分析、仪表盘、记分卡以及数据挖掘模型等。 SpagoBI不正确过滤'Short document metadata'中'Description'字段的输入数据，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 SpagoBI 4.0 厂商补丁： SpagoBI ----- SpagoBI v4.1已经修复该漏洞，建议用户下载更新：...

SpagoBI 'Description'字段HTML注入漏洞

Bugtraq ID:65915 CVE ID:CVE-2013-6233 SpagoBI提供一个基于J2EE的框架用于管理BI对象如报表、OLAP分析、仪表盘、记分卡以及数据挖掘模型等。 SpagoBI不正确过滤'Short document metadata'中'Description'字段的输入数据，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 SpagoBI 4.0 厂商补丁： SpagoBI ----- SpagoBI v4.1已经修复该漏洞，建议用户下载更新：...

SpagoBI 4.0 - Arbitrary XSS File Upload

Exploit for php platform in category web applications Introduction SpagoBI1 is an Open Source Business Intelligence suite, belonging to the free/open source SpagoWorld initiative, founded and supported by Engineering Group2. It offers a large range of analytical functions, a highly functional...

SpagoBI 4.0 - Persistent XSS Vulnerability

Exploit for php platform in category web applications 1. Vulnerability Information CVE reference: CVE-2013-6232 CVSS v2 Base Score: 4 CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N Component/s: SpagoBI Class: Input Manipulation 2. Introduction SpagoBI1 is an Open Source Business Intelligence suite,...

SpagoBI 4.0 - Persistent HTML Script Insertion

Exploit for php platform in category web applications SpagoBI1 is an Open Source Business Intelligence suite, belonging to the free/open source SpagoWorld initiative, founded and supported by Engineering Group2. It offers a large range of analytical functions, a highly functional semantic layer...

SpagoBI 4.0 - Persistent HTML Script Insertion

SpagoBI 4.0 - Persistent HTML Script Insertion 01. Advisory Information Title: Persistent HTML Script Insertion permits offsite-bound forms Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02...

SpagoBI 4.0 - Arbitrary Cross-Site Scripting / Arbitrary File Upload

Advisory Information Title: XSS File Upload Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02. Vulnerability Information CVE reference: CVE-2013-6234 CVSS v2 Base Score: 4 CVSS v2 Vector:...

SpagoBI 4.0 - Persistent HTML Script Insertion

Advisory Information Title: Persistent HTML Script Insertion permits offsite-bound forms Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02. Vulnerability Information CVE reference: CVE-2013-6233...

SpagoBI 4.0 - Persistent Cross-Site Scripting

SpagoBI 4.0 - Persistent Cross-Site Scripting 01. Advisory Information Title: Persistent Cross-Site Scripting XSS in SpagoBI Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Informati...

SpagoBI 4.0 - Arbitrary Cross-Site Scripting Arbitrary File Upload

SpagoBI 4.0 - Arbitrary Cross-Site Scripting Arbitrary File Upload 01. Advisory Information Title: XSS File Upload Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02. Vulnerability Information CVE...

SpagoBI 4.0 - Persistent Cross-Site Scripting

Advisory Information Title: Persistent Cross-Site Scripting XSS in SpagoBI Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Information CVE reference: CVE-2013-6232 CVSS v2 Base...

SpagoBI 4.0 Cross Site Scripting / Shell Upload

Advisory Information Title: XSS File Upload Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02. Vulnerability Information CVE reference: CVE-2013-6234 CVSS v2 Base Score: 4 CVSS v2 Vector:...

SpagoBI 4.0 Stored Cross Site Scripting

Advisory Information Title: Persistent Cross-Site Scripting XSS in SpagoBI Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Information CVE reference: CVE-2013-6232 CVSS v2 Base...

SpagoBI 4.0 HTML Injection

Advisory Information Title: Persistent HTML Script Insertion permits offsite-bound forms Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02. Vulnerability Information CVE reference: CVE-2013-6233...

SpagoBI 4.0 - Privilege Escalation

SpagoBI 4.0 - Privilege Escalation 01. Advisory Information Title: Remote Privilege Escalation in SpagoBI Date published: 2013-02-28 Date of last update: 2013-02-28 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Information CVE reference:...

SpagoBI 4.0 Privilege Escalation

Advisory Information Title: Remote Privilege Escalation in SpagoBI Date published: 2013-02-28 Date of last update: 2013-02-28 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Information CVE reference: CVE-2013-6231 CVSS v2 Base Score: 9...

SpagoBI 4.0 - Privilege Escalation Vulnerability

Exploit for multiple platform in category web applications 01. Advisory Information Title: Remote Privilege Escalation in SpagoBI Date published: 2013-02-28 Date of last update: 2013-02-28 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability...

SpagoBI 4.0 - Privilege Escalation

Advisory Information Title: Remote Privilege Escalation in SpagoBI Date published: 2013-02-28 Date of last update: 2013-02-28 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Information CVE reference: CVE-2013-6231 CVSS v2 Base Score: 9...