Vulnerabilities

TI-2020-17236 CVE-2020-28408 · GHSA-h922-r9v4-x3j6

The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard.

LOW 25

The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00545 Published 2020-11-10 No fix listed CWE-79

TI-2020-17237 CVE-2020-28409 · GHSA-p2vw-p6qj-j24f

The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g…

LOW 25

The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g., a button) when events such as click, hover, etc.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00557 Published 2020-11-10 No fix listed CWE-79

TI-2018-13133 CVE-2018-18569 · GHSA-7v6j-4w9v-pgvx

The Dundas BI server before 5.0.1.1010 is vulnerable to a Server-Side Request Forgery…

MEDIUM 40

The Dundas BI server before 5.0.1.1010 is vulnerable to a Server-Side Request Forgery attack, allowing an attacker to forge arbitrary requests (with certain restrictions) that will be executed on behalf of the attacker,…

CVSS 3.0HIGH 8.6 Network No auth No interaction EPSS 0.01472 Published 2019-02-11 No fix listed CWE-918

Vulnerabilities

Filters

The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard.

The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g…

The Dundas BI server before 5.0.1.1010 is vulnerable to a Server-Side Request Forgery…