KnowageLabs

Records30All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

KnowageLabs records in CISA KEV

No KnowageLabs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Knowage 21 records HIGH Spagobi 8 records HIGH

Records

30 records

TI-2025-37342 CVE-2025-59954

Knowage Contains a Remote Code Execution Vulnerability

HIGH 81

Knowage is an open source analytics and business intelligence suite.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00549 Published 2025-09-29 Fixed in 8.1.27 CWE-94

TI-2023-20050 CVE-2023-38702

Knowage Server vulnerable to path traversal via upload functionality

HIGH 76

Knowage is an open source analytics and business intelligence suite.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01172 Published 2023-08-04 Fixed in 8.1.8 CWE-22

TI-2024-36669 CVE-2024-54794 · GHSA-36qv-62j7-22cf

The script input feature of SpagoBI 3.5.1 allows arbitrary code execution.

HIGH 74

The script input feature of SpagoBI 3.5.1 allows arbitrary code execution.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.13184 Published 2025-01-21 No fix listed CWE-77

TI-2023-17600 CVE-2023-35154

Knowage-Server vulnerable to account validation bypass

HIGH 71

Knowage is an open source analytics and business intelligence suite.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0038 Published 2023-06-23 Fixed in 8.1.8 CWE-287

TI-2023-19080 CVE-2023-37472

Query injection in Knowage server

HIGH 67

Knowage is an open source suite for business analytics.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00706 Published 2023-07-14 Fixed in 8.1.8 CWE-89

TI-2023-18613 CVE-2023-36819

Knowage-Server vulnerable to Path traversal in download functionalities

MEDIUM 62

Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00791 Published 2023-07-03 Fixed in 8.1.8 CWE-22

TI-2024-36668 CVE-2024-54792 · GHSA-5c2x-vx3w-4336

A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the…

MEDIUM 60

A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.003 Published 2025-01-21 No fix listed CWE-352

TI-2022-18671 CVE-2022-39295

Improper Neutralization of Alternate XSS Syntax in Knowage-Server

MEDIUM 60

Knowage is an open source suite for modern business analytics alternative over big data systems.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00714 Published 2022-10-13 Fixed in 7.4.22, 8.0.9 CWE-79

TI-2024-36670 CVE-2024-54795 · GHSA-vc2j-xx32-6w44

SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the…

MEDIUM 58

SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer function.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0053 Published 2025-01-21 No fix listed CWE-79

TI-2013-05242 CVE-2013-6231 · GHSA-r9jv-73jq-9qcw

SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script

MEDIUM 50

SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.09881 Published 2020-01-10 No fix listed CWE-269

TI-2019-09881 CVE-2019-13188 · GHSA-p8c6-fx85-c47c

In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application.

MEDIUM 47

In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02462 Published 2019-09-05 No fix listed CWE-287

TI-2021-10743 CVE-2021-30214 · GHSA-hwrw-j4pc-89pr

Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in…

MEDIUM 45

Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.23795 Published 2021-05-12 No fix listed CWE-74

TI-2013-05245 CVE-2013-6234 · GHSA-6mr3-4w8x-ffcp

Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1…

MEDIUM 44

Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.06706 Published 2019-11-22 No fix listed CWE-434

TI-2024-38199 CVE-2024-57971 · GHSA-v793-w449-37r3

DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before…

MEDIUM 42

DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00725 Published 2025-02-16 Fixed in 8.1.30 CWE-99

TI-2021-10639 CVE-2021-30055 · GHSA-p8qf-chx8-32g2

A SQL injection vulnerability in Knowage Suite version 7.1 exists in the…

MEDIUM 41

A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01602 Published 2021-04-05 No fix listed CWE-89

TI-2019-10029 CVE-2019-13348 · GHSA-h3q3-rm4g-pqjh

In Knowage through 6.1.1, an authenticated user who accesses the datasources page will…

MEDIUM 41

In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01467 Published 2019-08-28 No fix listed CWE-522

TI-2025-36199 CVE-2025-58441

Knowage is vulnerable to blind server-side request forgery (SSRF)

LOW 33

Knowage is an open source analytics and business intelligence suite.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00189 Published 2026-01-07 Fixed in 8.1.37 CWE-918

TI-2014-06079 CVE-2014-7296 · GHSA-jg2p-3mcj-hp8f

The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set…

LOW 33

The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURE_SECURE_PROCESSING, which allows remote authenticated users to execute arbitrary Java code via a crafted XSL document.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01696 Published 2014-10-08 No fix listed CWE-94

TI-2021-10742 CVE-2021-30213 · GHSA-rhgp-mf49-p5gr

Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS).

LOW 32

Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02721 Published 2021-05-12 No fix listed CWE-79

TI-2021-10642 CVE-2021-30058 · GHSA-9m4q-9h42-w37g

Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS).

LOW 29

Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00994 Published 2021-04-05 No fix listed CWE-79

TI-2019-09882 CVE-2019-13189 · GHSA-mc6p-vg7m-2x3q

In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.

LOW 29

In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00943 Published 2019-08-28 No fix listed CWE-79

TI-2018-08856 CVE-2018-12355 · GHSA-89g4-q822-44j2

Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the…

LOW 29

Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00768 Published 2018-06-13 No fix listed CWE-79

TI-2019-09883 CVE-2019-13190 · GHSA-h2j8-mg54-r682

In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token.

LOW 27

In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01387 Published 2019-09-05 No fix listed CWE-287

TI-2013-05244 CVE-2013-6233 · GHSA-qp96-xpcw-x33j

Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote…

LOW 26

Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field in the "Short document metadata."

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03211 Published 2014-03-07 No fix listed CWE-79

TI-2021-10741 CVE-2021-30212 · GHSA-w852-vpw3-jf4v

Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS).

LOW 25

Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00581 Published 2021-05-12 No fix listed CWE-79

Open these records in search →