Wastasy

**Nome do software vulnerável e versões afetadas: Versões do SpagoBI anteriores à 4.1 Descrição: O problema está relacionado a um erro de escalonamento de privilégios no script AdapterHTTP. Recomendações: Para versões anteriores à 4.1, atualize para a versão 4.1 ou posterior para resolver o problema.

The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension to the Worksheet designer, and then accessing it via a direct request. This is related to an unrestricted file upload vulnerability.

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the Description field in the "Short document metadata."

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `listenertype` or `currentlistener` parameter to "mondetail.jsp" or the `ArraySQL` parameter to "mondetail.jsp", "jamonadmin.jsp", "sql.jsp", or "exceptions.jsp".

A cross-site scripting (XSS) issue exists in the default markup formatter, allowing remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.

The issue allows remote authenticated users to obtain sensitive information, specifically cleartext passwords, by reading the value in the `sonarPassword` parameter from the jenkins/configure page.