CVE-2021-44726

KNIME Server prior to 4.13.4 is vulnerable to cross-site scripting via the old WebPortal login page. The root cause cited in CNVD is lack of proper validation of client-side data by the web application. Affected: KNIME Server versions before 4.13.4. Remediation: upgrade to KNIME Server 4.13.4 or ...

CVE-2022-44748

CVE-2022-44748 - KNIME Server Zip-Slip directory traversal . A vulnerability in KNIME Server’s ZIP archive extraction routines allows an authenticated user (with upload rights) to overwrite arbitrary files on the server’s filesystem. The root cause is directory traversal during workflow upload, e...

CVE-2021-45097

CVE-2021-45097 affects KNIME Server. Vulnerability arises from storing the administrator password in a file without proper access controls, allowing all local users to read it. Affected: KNIME Server versions 4.12.5 and earlier, and 4.13.x before 4.13.4 (when installed in unattended mode). Impact...

CVE-2021-44725

CVE-2021-44725 affects KNIME Server prior to 4.13.4, where a directory traversal vulnerability can be triggered by a crafted request for a client profile. The issue stems from insufficient validation/filtering of input paths, allowing access to files/directories outside the intended scope. Exploi...