CVE-2013-6234

CVE-2013-6234 describes an unrestricted file upload vulnerability in the SpagoBI Worksheet designer (versions before 4.1). A remote, authenticated user could upload a file with an executable extension and access it via a direct request to the file in an unspecified directory, enabling arbitrary c...

CVE-2013-6231

CVE-2013-6231 affects SpagoBI (primarily SpagoBI 4.0). The vulnerability is a privilege-escalation flaw in the AdapterHTTP servlet (ACTION_NAME=MANAGE_USER_ACTION) that can be triggered by crafted input, enabling a remote attacker to gain Administrator privileges after authenticating. Remediation...

CVE-2013-6232

CVE-2013-6232 corresponds to a persistent XSS in SpagoBI prior to v4.1. The vulnerability allows a restricted, authenticated user to insert a malicious note in the execution page, which can execute script when viewed by another user. Exploitation described as inserting a note containing javascrip...

CVE-2024-54794

Engineering Ingegneria Informatica SpagoBI version 3.5.1 and earlier are vulnerable to a Command Injection vulnerability within the script input feature. The root cause is the failure to properly neutralize special elements in the command input field, allowing an attacker to inject and execute ar...

CVE-2024-54792

SpagoBI version 3.5.1 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability within the user administration panel. The root cause is a lack of CSRF countermeasures in the panel used to manage user grants. An authenticated attacker can trick a victim with administrative righ...

CVE-2013-6233

CVE-2013-6233 affects SpagoBI (Open Source BI suite). The vulnerability is a cross-site scripting (XSS) flaw in the input handling of the Description field in the Short document metadata, allowing remote attackers with authentication to inject arbitrary HTML/script. Technical description and advi...

CVE-2024-54795

Engineering Ingegneria Informatica SpagoBI version 3.5.1 and earlier are affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities within the create/edit forms of the worksheet designer function. An attacker with sufficient permissions to access the worksheet designer can inject mali...

CVE-2014-7296

CVE-2014-7296 affects SpagoBI 5.0.0: the accessibility engine’s default config does not enable FEATURE_SECURE_PROCESSING, allowing remote authenticated users to execute arbitrary Java code through a crafted XSL document. Impact is code execution with partial confidentiality/integrity/availability...