CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-57971
https://notcve.org/view.php?id=CVE-2024-57971
16 Feb 2025 — DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name. • https://github.com/KnowageLabs/Knowage-Server/commit/f7d0362f737e1b0db1cc9cc95b1236d62d83dd0c • CWE-99: Improper Control of Resource Identifiers ('Resource Injection') •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 1CVE-2023-38702 – Knowage Server vulnerable to path traversal via upload functionality
https://notcve.org/view.php?id=CVE-2023-38702
04 Aug 2023 — Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-services/dossier/importTemplateFile` allows authenticated users to upload `template file` on the server, but does not need any authorization to be reached. When the JSP file is uploaded, the attacker just needs to connect to `/knowageqbeengine/foo.jsp` to gain code execution on the server. By exploiting this vulnerability, an attacker with low privilege... • https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-7mjh-73q3-c3fc • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37472 – Query injection in Knowage server
https://notcve.org/view.php?id=CVE-2023-37472
14 Jul 2023 — Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without prior sanitization. An attacker can create specially crafted HQL queries that will break subsequent SQL queries generated by the Hibernate engine. The endpoint `_/knowage/restful-services/2.0/documents/listDocument_` calls the `_countBIObjects_` method of the `_BIObjectDAOHibImpl_` object with the user supplied `_label_` parameter without prior sanitization. This can lead to SQL... • https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-2j3f-f696-7rgj • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-36819 – Knowage-Server vulnerable to Path traversal in download functionalities
https://notcve.org/view.php?id=CVE-2023-36819
03 Jul 2023 — Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint `_/knowage/restful-services/dossier/importTemplateFile_` allows authenticated users to download template hosted on the server. However, starting in the 6.x.x branch and prior to version 8.1.8, the application does not sanitize the `_templateName_ `parameter allowing an attacker to use `*../*` in it, and escaping the directory the template are normally placed and download an... • https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-jw99-hxxj-75g2 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-35154 – Knowage-Server vulnerable to account validation bypass
https://notcve.org/view.php?id=CVE-2023-35154
23 Jun 2023 — Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activate their account without having to click on the link included in the email, allowing them access to the application as a normal user. This issue has been patched in version 8.1.8. • https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-48hp-jvv8-cf62 • CWE-287: Improper Authentication •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 1CVE-2022-39295 – Improper Neutralization of Alternate XSS Syntax in Knowage-Server
https://notcve.org/view.php?id=CVE-2022-39295
13 Oct 2022 — Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the `XSSRequestWrapper::stripXSS` method can be bypassed. Versions 7.4.22, 8.0.9, and 8.1.0 contain patches for this issue. There are no known workarounds. Knowage es una suite de código abierto para una alternativa de análisis empresarial moderna sobre sistemas d... • https://github.com/KnowageLabs/Knowage-Server/blob/b079a654c1708f82f6914c55be6715ad621d9edd/knowageutils/src/main/java/it/eng/spagobi/utilities/filters/XSSRequestWrapper.java#L82-L206 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-87: Improper Neutralization of Alternate XSS Syntax •
CVSS: 6.1EPSS: 3%CPEs: 1EXPL: 1CVE-2021-30213
https://notcve.org/view.php?id=CVE-2021-30213
12 May 2021 — Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter. Knowage Suite versión 7.3, es vulnerable a un ataque de tipo cross-site scripting (XSS) reflejado no autenticado. Un atacante puede inyectar un script web arbitrario en "/servlet/AdapterHTTP" por medio del parámetro "targetService" • https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/XSS-KnowageSuite7-3_unauth.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30214
https://notcve.org/view.php?id=CVE-2021-30214
12 May 2021 — Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter. Knowage Suite versión 7.3, es vulnerable a una Inyección de Plantillas del Lado del Cliente Almacenadas en "/knowage/restful-services/signup/update" por medio del parámetro "name" • https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/CSTI-KnowageSuite7-3.md • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30212
https://notcve.org/view.php?id=CVE-2021-30212
12 May 2021 — Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter. Knowage Suite versión 7.3, es vulnerable a un ataque de tipo Cross-Site Scripting (XSS) almacenado. Un atacante puede inyectar un script web arbitrario en "/knowage/restful-services/documentnotes/saveNote" por medio del parámetro "nota" • https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/Stored-XSS-KnowageSuite7-3-notes.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-30211
https://notcve.org/view.php?id=CVE-2021-30211
12 May 2021 — Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter. Knowage Suite versión 7.3, es vulnerable a un ataque de tipo Cross-Site Scripting (XSS) almacenado. Un atacante puede inyectar un script web arbitrario en "/knowage/restful-services/signup/update" por medio del parámetro "surname" • https://github.com/piuppi/Proof-of-Concepts/blob/main/Engineering/Stored-XSS-KnowageSuite7-3-surname.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •