324 matches found
CVE-2025-27141 Metabase Enterprise Edition allows cached questions to leak data to impersonated users
Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see resul...
CVE-2025-27141 Metabase Enterprise Edition allows cached questions to leak data to impersonated users
Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see resul...
Metabase 安全漏洞
Metabase is an open source data analytics platform from the US-based Metabase Inc. A security vulnerability exists in Metabase Enterprise Edition. An attacker exploiting the vulnerability could view data that should not be accessible. The following versions are affected: version 1.47.0 through...
PT-2025-7794 · Metabase · Metabase Enterprise Edition
Name of the Vulnerable Software and Affected Versions: Metabase Enterprise Edition versions 1.47.0 through 1.49.x Metabase Enterprise Edition versions 1.50.0 through 1.50.35 Metabase Enterprise Edition versions 1.51.0 through 1.51.13 Metabase Enterprise Edition versions 1.52.0 through 1.52.10...
CVE-2022-24854
Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...
CVE-2022-24855
Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint /internal that can allow for cross site scripting XSS attacks, potentially leading to phishing attempts with malicious links that could lead to...
CVE-2022-39362
Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9...
CVE-2022-39361
Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 Sample Database could allow Remote Code Execution RCE, which can be abused by users able to write SQL queries on H2 databases. This issue is patched in versions 0.44.5...
CVE-2024-55951
Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There ar...
CVE-2024-55951
CVE-2024-55951 (Metabase) affects Metabase 1.52.x prior to 1.52.2.5, where sandboxed users could view field filter values from other sandboxed users. Root cause: sandbox isolation flaw in new sandboxing configurations created between 1.52.0 and 1.52.2.4. Impact: information disclosure within sand...
CVE-2024-55951 Metabase sandboxed users could see filter values from other sandboxed users
Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There ar...
CVE-2024-55951 Metabase sandboxed users could see filter values from other sandboxed users
Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There ar...
CVE-2024-55951 Metabase sandboxed users could see filter values from other sandboxed users
Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There ar...
Metabase 信息泄露漏洞
Metabase is an open source data analytics platform from Metabase, Inc. in the United States. An information disclosure vulnerability exists in Metabase that stems from a sandbox user being able to see field filter values from other sandbox users...
Exploit for CVE-2023-38646
CVE-2023-38646-PoC-Metabase Proof-of-Concept script for exploi...
Exploit for CVE-2023-38646
Metabase Pre-Authentication RCE CVE-2023-38646 CVE-2023-38...
Metabase GeoJSON API Local File Inclusion Vulnerability
Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data...
AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services
The threat actors behind the AndroxGh0st malware are now exploiting a broader set of security flaws impacting various internet-facing applications, while also deploying the Mozi botnet malware. "This botnet utilizes remote code execution and credential-stealing methods to maintain persistent...
Openfire SSRF (CVE-2019-18394)
The version of Openfire installed on the remote host is prior to 4.4.3. It is, therefore, affected by a server side request forgery vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. Note that Nessus has not tested...