Vulnerabilities > Microstrategy > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-07-19 | CVE-2019-12453 | Cross-site Scripting vulnerability in Microstrategy web 10.1/7 In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation. | 4.3 |
| 2019-07-17 | CVE-2019-12475 | Cross-site Scripting vulnerability in Microstrategy web 10.1/10.4/7 In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation. | 4.3 |
| 2019-05-14 | CVE-2018-6885 | Path Traversal vulnerability in Microstrategy web Services 10.4 An issue was discovered in MicroStrategy Web Services (the Microsoft Office plugin) before 10.4 Hotfix 7, and before 10.11. | 5.0 |
| 2018-11-01 | CVE-2018-18777 | Path Traversal vulnerability in Microstrategy web 7 Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. | 4.0 |
| 2018-11-01 | CVE-2018-18776 | Cross-site Scripting vulnerability in Microstrategy web 7 Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the admin/admin.asp ShowAll parameter. | 4.3 |
| 2018-11-01 | CVE-2018-18775 | Cross-site Scripting vulnerability in Microstrategy web 7 Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter. | 4.3 |