CVE-2023-41265

CVE-2023-41265 affects Qlik Sense Enterprise for Windows. The issue is an HTTP Request Smuggling vulnerability caused by tunneling HTTP requests in the raw HTTP traffic, enabling a remote attacker to escalate privileges by crafting requests that execute on the backend repository server. Affected ...

CVE-2023-41266

CVE-2023-41266 is a path traversal vulnerability in Qlik Sense Enterprise for Windows that allows an unauthenticated attacker to establish an anonymous session by sending crafted HTTP requests to unauthorized endpoints. Affected versions include May 2023 Patch 3 and earlier, February 2023 Patch 7...

CVE-2023-48365

CVE-2023-48365 affects Qlik Sense Enterprise for Windows. The issue arises from improper validation of HTTP headers, enabling an unauthenticated remote attacker to tunnel HTTP requests and execute them on the backend server hosting the repository application (RCE potential). This vulnerability is...

CVE-2021-36761

The CVE-2021-36761 entry concerns Qlik Sense, specifically its GeoAnalytics feature in the April 2020 patch 4, which allows server-side request forgery (SSRF). According to CVSS 3.1 data, it is a network-based, low-complexity issue with no privileges required and no user interaction, impacting co...

CVE-2022-0564

CVE-2022-0564 affects Qlik Sense Enterprise on Windows. The vulnerability exists in the /internal_forms_authentication/ endpoint and enables an unauthenticated/remote attacker to enumerate domain user accounts by measuring response times, conditioned on LDAP being configured. Impact is informatio...

CVE-2019-11628

The CVE affects QlikView Server (pre-11.20 SR19, 12.00, 12.10 before SR11, 12.20 before SR9, 12.30 before SR2) and Qlik Sense Enterprise / Qlik Analytics Platform installations lacking specific patches (Feb 2018 Patch 4, Apr 2018 Patch 3, Jun 2018 Patch 3, Sep 2018 Patch 4, Nov 2018 Patch 4, or F...

CVE-2025-61138

CVE-2025-61138 affects Qlik Sense Enterprise v14.212.13. The issue is an information leak via the '/dev-hub/' directory, exposing potentially sensitive data. The CVE metadata indicates a high-severity impact (CVSS v3.1: 7.5) with network attack vector and no user interaction required. Some connec...