Christian Catalano

Name of the Vulnerable Software and Affected Versions: SpagoBI versions prior to 4.1 Description: The issue is related to a privilege escalation error in the AdapterHTTP script. Recommendations: For versions prior to 4.1, update to version 4.1 or later to resolve the issue.

The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension to the Worksheet designer, and then accessing it via a direct request. This is related to an unrestricted file upload vulnerability.

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the Description field in the "Short document metadata."

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `listenertype` or `currentlistener` parameter to "mondetail.jsp" or the `ArraySQL` parameter to "mondetail.jsp", "jamonadmin.jsp", "sql.jsp", or "exceptions.jsp".

A cross-site scripting (XSS) issue exists in the default markup formatter, allowing remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.

The issue allows remote authenticated users to obtain sensitive information, specifically cleartext passwords, by reading the value in the `sonarPassword` parameter from the jenkins/configure page.