Medium

DATE	CVE	VULNERABILITY TITLE	RISK
2019-11-22	CVE-2013-6234	Unrestricted Upload of File with Dangerous Type vulnerability in ENG Spagobi 4.0 Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, aka "XSS File Upload." network eng CWE-434	6.0
2014-10-08	CVE-2014-7296	Code Injection vulnerability in ENG Spagobi 5.0 The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURE_SECURE_PROCESSING, which allows remote authenticated users to execute arbitrary Java code via a crafted XSL document. network eng CWE-94	6.8
2014-03-09	CVE-2013-6233	Cross-Site Scripting vulnerability in ENG Spagobi 4.0 Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field in the "Short document metadata." network eng CWE-79	4.3