1035 matches found
Apache Superset 安全漏洞
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an authorization issue vulnerability that stems from improper authorization settings that can be exploited by an attacker to use this API when FABADDSECURITYAPI is...
Apache Superset Signed Cookie Privilege Escalation
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Superset Signed Cookie Priv Esc', 'Description' = %q Apache Superset versions 'h00die', MSF module 'paradoxis', original flask-unsign tool...
Exploit for Improper Input Validation in Apache Superset
CVE-2024-34693 Exploit This repository contains a sophisticat...
The vulnerability of the version/query_to_xml/inet_server_addr/inet_client_addr function in Apache Superset visualization software allows a hacker to bypass existing security restrictions.
The vulnerability of the version/querytoxml/inetserveraddr/inetclientaddr functions in Apache Superset visualization software is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to circumvent existing security...
SQL Injection
Apache Superset is vulnerable to SQL Injection. The vulnerability is caused due to improper handling of special elements used in SQL commands, specifically certain engine-specific functions are not checked, allowing attackers to bypass SQL authorization...
Apache Superset SQL Injection Vulnerability (CNVD-2024-35190)
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in the back-end database...
GHSA-2Q6J-VPVR-6PVJ Apache Superset vulnerable to improper SQL authorization
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...
Apache Superset vulnerable to improper SQL authorization
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...
CVE-2024-39887
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...
CVE-2024-39887 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...
CVE-2024-39887
CVE-2024-39887 describes an SQL Injection in Apache Superset due to improper neutralization of engine-specific SQL functions. The vulnerability affects “Apache Superset” and allows bypassing SQL authorization via certain PostgreSQL functions, mitigated by a config key DISALLOWED_SQL_FUNCTIONS. Th...
CVE-2024-39887 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...
CVE-2024-39887 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...
PT-2024-5103
Name of the Vulnerable Software and Affected Versions: Apache Superset versions prior to 4.0.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not...
Apache Superset 安全漏洞
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in the back-end database...
The vulnerability of the Apache Superset data visualization software lies in insufficient validation of input data. This allows attackers to execute arbitrary SQL commands and disclose sensitive information that should be protected.
The vulnerability of the Apache Superset data visualization software relates to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands and disclose sensitive information that is protected by the system...
Improper Input Validation
Apache Superset is vulnerable to Improper Input Validation. The vulnerability is due to a lack of validation of user-supplied input. If an authenticated attacker creates a MariaDB connection with the localinfile option enabled, they can execute a specific MySQL/MariaDB SQL command which results i...
GHSA-HCR7-CQWC-Q5GQ Apache Superset server arbitrary file read
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with localinfile enabled. If both the MariaDB server off by default and the local mysql client on the web server are set to allow for local infile, it's possible for the...
Apache Superset server arbitrary file read
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with localinfile enabled. If both the MariaDB server off by default and the local mysql client on the web server are set to allow for local infile, it's possible for the...
CVE-2024-34693
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with localinfile enabled. If both the MariaDB server off by default and the local mysql client on the web server are set to allow for local infile, it's possible for the...