knowage-suite knowage vulnerabilities and exploits

(subscribe to this query)

4.9

CVSSv3

In Knowage up to and including 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.

Knowage-suite Knowage

5.3

CVSSv3

In Knowage up to and including 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.

Knowage-suite Knowage

8.8

CVSSv3

Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request.

Knowage-suite Knowage 6.1.1

6.1

CVSSv3

Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.

Knowage-suite Knowage 6.1.1

8.8

CVSSv3

A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report.

Eng Knowage

6.1

CVSSv3

Knowage Suite prior to 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBI_HOST' parameter.

Eng Knowage

4.8

CVSSv3

A stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject arbitrary HTML in "/restful-services/2.0/analyticalDrivers" via the 'LABEL' and 'NAME' parameters.

Eng Knowage

5.4

CVSSv3

Knowage Suite prior to 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage.

Eng Knowage

5.4

CVSSv3

Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter.

5.4

CVSSv3

Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter.

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook