CVE-2013-6234

CVE-2013-6234 describes an unrestricted file upload vulnerability in the SpagoBI Worksheet designer (versions before 4.1). A remote, authenticated user could upload a file with an executable extension and access it via a direct request to the file in an unspecified directory, enabling arbitrary c...

CVE-2013-6231

CVE-2013-6231 affects SpagoBI (primarily SpagoBI 4.0). The vulnerability is a privilege-escalation flaw in the AdapterHTTP servlet (ACTION_NAME=MANAGE_USER_ACTION) that can be triggered by crafted input, enabling a remote attacker to gain Administrator privileges after authenticating. Remediation...

CVE-2013-6232

CVE-2013-6232 corresponds to a persistent XSS in SpagoBI prior to v4.1. The vulnerability allows a restricted, authenticated user to insert a malicious note in the execution page, which can execute script when viewed by another user. Exploitation described as inserting a note containing javascrip...

CVE-2024-54794

Summary: CVE-2024-54794 affects SpagoBI 3.5.1 and earlier, where the script input feature enables arbitrary code execution through Groovy script input. This is a command-injection style vulnerability in the web UI that can be exploited by a user with access to insert scripts, potentially leading ...

CVE-2024-54792

CVE-2024-54792 : SpagoBI 3.5.1 is affected by a CSRF vulnerability in the user administration panel. An authenticated attacker can induce a logged-in admin to perform unwanted actions (e.g., add/edit/delete users) on behalf of the victim via crafted requests. The issue is demonstrated in multiple...

CVE-2024-54795

CVE-2024-54795 affects the open‑source BI suite SpagoBI v3.5.1 and earlier . Multiple stored XSS vulnerabilities exist in the worksheet designer’s create/edit forms. Exploitation requires user interaction and sufficient permissions to access the worksheet designer, enabling an attacker to inject ...

CVE-2013-6233

CVE-2013-6233 affects SpagoBI (Open Source BI suite). The vulnerability is a cross-site scripting (XSS) flaw in the input handling of the Description field in the Short document metadata, allowing remote attackers with authentication to inject arbitrary HTML/script. Technical description and advi...

CVE-2014-7296

CVE-2014-7296 affects SpagoBI 5.0.0: the accessibility engine’s default config does not enable FEATURE_SECURE_PROCESSING, allowing remote authenticated users to execute arbitrary Java code through a crafted XSL document. Impact is code execution with partial confidentiality/integrity/availability...