Vulnerabilities > Microstrategy > Microstrategy WEB > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-04-02 | CVE-2020-11453 | Server-Side Request Forgery (SSRF) vulnerability in Microstrategy web 10.4 Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. | 5.3 |
| 2020-04-02 | CVE-2020-11452 | Server-Side Request Forgery (SSRF) vulnerability in Microstrategy web 10.1/10.4/7 Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. | 4.3 |
| 2020-04-02 | CVE-2020-11454 | Cross-site Scripting vulnerability in Microstrategy web 10.4 Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard. | 5.4 |
| 2019-07-19 | CVE-2019-12453 | Cross-site Scripting vulnerability in Microstrategy web 10.1/7 In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation. | 6.1 |
| 2019-07-17 | CVE-2019-12475 | Cross-site Scripting vulnerability in Microstrategy web 10.1/10.4/7 In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation. | 6.1 |
| 2018-11-01 | CVE-2018-18777 | Path Traversal vulnerability in Microstrategy web 7 Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. | 4.3 |
| 2018-11-01 | CVE-2018-18776 | Cross-site Scripting vulnerability in Microstrategy web 7 Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the admin/admin.asp ShowAll parameter. | 6.1 |
| 2018-11-01 | CVE-2018-18775 | Cross-site Scripting vulnerability in Microstrategy web 7 Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter. | 6.1 |