Knowage Suite
Products
1- 7 CVEs
Recent CVEs
7| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-30055 | Hig | 0.57 | 8.8 | 0.02 | Apr 5, 2021 | A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report. | ||
| CVE-2018-12354 | Hig | 0.57 | 8.8 | 0.00 | Jun 13, 2018 | Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request. | ||
| CVE-2018-12353 | Med | 0.40 | 6.1 | 0.01 | Jun 13, 2018 | Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue. | ||
| CVE-2021-30056 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage. | ||
| CVE-2019-14278 | Med | 0.35 | 5.3 | 0.01 | Sep 5, 2019 | In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page. | ||
| CVE-2019-13349 | Med | 0.32 | 4.9 | 0.01 | Sep 5, 2019 | In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes. | ||
| CVE-2021-30057 | Med | 0.31 | 4.8 | 0.01 | Apr 5, 2021 | A stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject arbitrary HTML in "/restful-services/2.0/analyticalDrivers" via the 'LABEL' and 'NAME' parameters. |
- risk 0.57cvss 8.8epss 0.02
A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report.
- risk 0.57cvss 8.8epss 0.00
Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request.
- risk 0.40cvss 6.1epss 0.01
Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.
- risk 0.35cvss 5.4epss 0.01
Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage.
- risk 0.35cvss 5.3epss 0.01
In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.
- risk 0.32cvss 4.9epss 0.01
In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.
- risk 0.31cvss 4.8epss 0.01
A stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject arbitrary HTML in "/restful-services/2.0/analyticalDrivers" via the 'LABEL' and 'NAME' parameters.