PatchTheCVE: knowage-suitehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2019-14278: In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet pagehttps://patchthecve.com/cve/CVE-2019-14278.htmlhttps://patchthecve.com/cve/CVE-2019-14278.htmlWed, 17 Jun 2026 02:18:06 +0000MEDIUM 5.3: In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.CVE-2019-13349: In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashttps://patchthecve.com/cve/CVE-2019-13349.htmlhttps://patchthecve.com/cve/CVE-2019-13349.htmlWed, 17 Jun 2026 02:16:37 +0000MEDIUM 4.9: In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.CVE-2018-12354: Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.https://patchthecve.com/cve/CVE-2018-12354.htmlhttps://patchthecve.com/cve/CVE-2018-12354.htmlWed, 17 Jun 2026 01:37:35 +0000HIGH 8.8: Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request.CVE-2018-12353: Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.https://patchthecve.com/cve/CVE-2018-12353.htmlhttps://patchthecve.com/cve/CVE-2018-12353.htmlWed, 17 Jun 2026 01:37:35 +0000MEDIUM 6.1: Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.