Vulnerabilities

TI-2024-36670 CVE-2024-54795 · GHSA-vc2j-xx32-6w44

SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the…

MEDIUM 58

SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer function.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0053 Published 2025-01-21 No fix listed CWE-79

TI-2024-36669 CVE-2024-54794 · GHSA-36qv-62j7-22cf

The script input feature of SpagoBI 3.5.1 allows arbitrary code execution.

HIGH 74

The script input feature of SpagoBI 3.5.1 allows arbitrary code execution.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.13184 Published 2025-01-21 No fix listed CWE-77

TI-2024-36668 CVE-2024-54792 · GHSA-5c2x-vx3w-4336

A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the…

MEDIUM 60

A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.003 Published 2025-01-21 No fix listed CWE-352

TI-2013-05242 CVE-2013-6231 · GHSA-r9jv-73jq-9qcw

SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script

MEDIUM 50

SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.09881 Published 2020-01-10 No fix listed CWE-269

TI-2013-05245 CVE-2013-6234 · GHSA-6mr3-4w8x-ffcp

Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1…

MEDIUM 44

Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.06706 Published 2019-11-22 No fix listed CWE-434

TI-2014-06079 CVE-2014-7296 · GHSA-jg2p-3mcj-hp8f

The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set…

LOW 33

The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURE_SECURE_PROCESSING, which allows remote authenticated users to execute arbitrary Java code via a crafted XSL document.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01696 Published 2014-10-08 No fix listed CWE-94

TI-2013-05244 CVE-2013-6233 · GHSA-qp96-xpcw-x33j

Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote…

LOW 26

Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field in the "Short document metadata."

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03211 Published 2014-03-07 No fix listed CWE-79

TI-2013-05243 CVE-2013-6232 · GHSA-3r87-cgc8-24q7

Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote…

LOW 23

Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via a document note in the execution page.

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.03642 Published 2014-03-07 No fix listed CWE-79

Vulnerabilities

Filters