528 matches found
CVE-2022-24855
CVE-2022-24855 (Metabase) affects Metabase versions prior to the patched releases. The vulnerability arises from an internal development endpoint “/_internal” that can be exploited to perform cross-site scripting (XSS), potentially enabling phishing with malicious links and account takeover. Affe...
CVE-2022-24855 XSS vulnerability in Metabase
Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint /internal that can allow for cross site scripting XSS attacks, potentially leading to phishing attempts with malicious links that could lead to...
PT-2022-16928
Name of the Vulnerable Software and Affected Versions Metabase affected versions not specified Description The issue concerns Metabase, an open source business intelligence and analytics application, specifically affecting users who make use of SQLite. SQLite has a feature called ATTACH DATABASE,...
PT-2022-16929
Name of the Vulnerable Software and Affected Versions Metabase versions prior to 0.40.8 and 1.40.8 Metabase versions prior to 0.41.7 and 1.41.7 Metabase versions prior to 0.42.4 and 1.42.4 Description Metabase is an open source business intelligence and analytics application. In affected versions...
CVE-2022-24854: Externally Controlled Reference to a Resource in Another Sphere
Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...
CVE-2022-24855: Improper Neutralization of Input During Web Page Generation
Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint /internal that can allow for cross site scripting XSS attacks, potentially leading to phishing attempts with malicious links that could lead to...
Metabase 跨站脚本漏洞
Metabase is an open source data analytics platform from Metabase, Inc. A cross-site scripting vulnerability exists in Metabase, which originates from an internal development endpoint that could allow cross-site scripting XSS attacks. The following products and versions are affected: x.42 - x.42.3...
Metabase 安全漏洞
Metabase is an open source data analytics platform from Metabase, Inc. in the United States. Metabase suffers from a security vulnerability that stems from the fact that SQLite has an FDW-like feature called ATTACH DATABASE that allows multiple SQLite databases to be connected via an initial join...
Metabase 信息泄露漏洞
Metabase is an open source data analytics platform from US-based Metabase, Inc. Metabase suffers from an information disclosure vulnerability that stems from having a proxy that is used to load JSON-mapped arbitrary URLs as part of our GeoJSON support. While we perform validation to not return th...
CVE-2022-24853: Exposure of Sensitive Information to an Unauthorized Actor
Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result ...
PT-2022-16927
Name of the Vulnerable Software and Affected Versions Metabase versions prior to 0.40.8 Metabase versions prior to 0.41.7 Metabase versions prior to 0.42.4 Metabase versions prior to 1.40.8 Metabase versions prior to 1.41.7 Metabase versions prior to 1.42.4 Description Metabase is an open source...
Metabase GeoJSON Map Information Disclosure (CVE-2021-41277)
An information disclosure vulnerability exists in Metabase GeoJSON Map. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase
CVE-2021-41277 MetaBase Arbitrary File Reading This is a...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase
CVE-2021-41277SSRF CVE-2021-41277 can be extended to an SSRF...
Metabase GeoJSON Local File Inclusion
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables because URLs were not validated prior to...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase
CVE-2021-41277 Usage 1. show help info bash /CVE...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase
CVE-2021-41277 Metabase GeoJSON map local fil...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase
CVE-2021-41277 !Alt texthttps://github.com...