CVE-2020-22983 | High | 8.1 | 2022-05-13 | A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a serve… |
CVE-2020-22987 | Medium | 6.1 | 2022-05-12 | Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the… |
CVE-2020-22986 | Medium | 6.1 | 2022-05-12 | Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the… |
CVE-2020-22985 | Medium | 6.1 | 2022-05-12 | Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the… |
CVE-2020-22984 | Medium | 6.1 | 2022-05-12 | Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via key… |
CVE-2022-29596 | Critical | 9.8 | 2022-05-11 | MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../wi… |
CVE-2020-24815 | Medium | 6.5 | 2020-11-24 | A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated us… |
CVE-2020-11453 | Medium | 5.3 | 2020-04-02 | Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The funct… |
CVE-2020-11452 | Medium | 4.3 | 2020-04-02 | Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an externa… |
CVE-2020-11454 | Medium | 5.4 | 2020-04-02 | Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard… |
CVE-2020-11451 | High | 7.2 | 2020-04-02 | The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files with arbitrary exten… |
CVE-2020-11450 | High | 7.5 | 2020-04-02 | Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.j… |
CVE-2019-18957 | Medium | 6.1 | 2019-11-14 | Microstrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS. |
CVE-2019-12453 | Medium | 6.1 | 2019-07-19 | In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation. |
CVE-2019-12475 | Medium | 6.1 | 2019-07-17 | In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation. |
CVE-2018-6885 | Critical | 9.8 | 2019-05-14 | An issue was discovered in MicroStrategy Web Services (the Microsoft Office plugin) before 10.4 Hotfix 7, and before 10.11. The vulnerability is unauthenticate… |
CVE-2018-18696 | High | 8.8 | 2018-12-28 | main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF attack has been prov… |
CVE-2018-18777 | Medium | 4.3 | 2018-11-01 | Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote authenticated users… |
CVE-2018-18776 | Medium | 6.1 | 2018-11-01 | Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the admin/admin… |
CVE-2018-18775 | Medium | 6.1 | 2018-11-01 | Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Ms… |