KNIME

KNIME Server: Path Traversal

Uploading workflows to KNIME Server may override arbitrary file system contents

Workflow names may be leaked to unauthenticated users in KNIME Business Hub

Unrestricted network access between execution contexts in KNIME Business Hub

KNIME Server: Cross-Site Scripting (XSS)

Ingress-nginx vulnerability in KNIME Business Hub

DataApp links without login expose job information to other user in KNIME Business Hub

Basic account information visible to unauthenticated user in Business Hub SaaS

Large tables in data apps can bring down execution services in KNIME Hub

Hard-coded password for object store of KNIME Business Hub

KNIME Analytics Platform: XML External Entity (XXE)

Denial-of-service on KNIME Business Hub when certain jobs are executed

CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub

KNIME Analytics Platform logs credentials of configured proxy when used as an executor

Auth bypass in Apache Artemis allows reading all internal messages

Sensitive information disclosure in KNIME Hub Web Application

Open redirect vulnerability in KNIME Business Hub

Cross-site scripting vulnerabilities in KNIME Business Hub web pages

KNIME Analytics Platform: security vulnerability

Opening workflows from untrusted resources may override arbitrary file system contents

Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

Unsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business Hub

Jobs can be saved as workflows with wrong permissions on KNIME Business Hub

KNIME Hub Web Application is vulnerable to clickjacking

Job details are visible to all team members on KNIME Business Hub