CVE-2018-12353

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 13, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-123548.8Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST requCVE-2018-123556.1Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.CVE-2018-123569.8An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses CVE-2018-123576.5Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions.CVE-2018-123584.3Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malicious site to read resCVE-2018-123598.8A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing daCVE-2018-123608.8A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. CVE-2018-123618.8An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics cCVE-2018-123628.8An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in aCVE-2018-123638.8A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old documentCVE-2018-123648.8NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 rCVE-2018-123656.5A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent
CVE-2018-12353: Medium severity, CVSS 6.1 | Vulnix