1035 matches found
CVE-2021-37839
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics...
CVE-2021-37839
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics...
Design/Logic Flaw
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics...
CVE-2021-37839
CVE-2021-37839 affects Apache Superset up to version 1.5.1. The issue is an access control error that allows authenticated users to read metadata for datasets they have no permission on. Affected metadata includes dataset name, columns, and metrics. The root cause is described in connected source...
CVE-2021-37839 Improper access to dataset metadata information
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics...
PT-2022-10673
Name of the Vulnerable Software and Affected Versions Apache Superset versions up to 1.5.1 Description The issue allows authenticated users to access metadata information related to datasets they have no permission on. This metadata includes the dataset name, columns, and metrics. Recommendations...
Apache Superset 访问控制错误漏洞
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an Access Control Error vulnerability that stems from improper access restrictions. A remote attacker could exploit the vulnerability to bypass implemented security...
GHSA-W358-RJ93-R5QV Apache Superset Stored XSS on Dashboard markdown
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The...
Apache Superset OS Command Injection
While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s os package in the web application process in versions 0.37.1. It was thus...
GHSA-CJ7G-H7RF-H8J9 Apache Superset OS Command Injection
While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s os package in the web application process in versions 0.37.1. It was thus...
Improper Encoding or Escaping of Output in Apache Superset
Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs...
GHSA-5FP8-C45M-256P Improper Encoding or Escaping of Output in Apache Superset
Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs...
GHSA-42Q4-9XF9-F67X Apache Superset allowed for database connections password leak for authenticated users
Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way...
Apache Superset allowed for database connections password leak for authenticated users
Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way...
Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page
Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...
GHSA-PG8M-4P8J-2P56 Apache Superset SQL Injection when template processing is enabled
Apache Superset up to and including 1.3.0 when configured with ENABLETEMPLATEPROCESSING on disabled by default allowed SQL injection when a malicious authenticated user sends an http request with a custom URL...
The vulnerability of the Apache Superset data visualization software lies in the lack of validation for XML objects’ sequences, which allows attackers to carry out attacks based on SQL injections.
The vulnerability of Apache Superset’s data visualization software lies in the lack of validation for the consistency of XML objects. Exploiting this vulnerability allows a remote attacker to carry out attacks based on SQL injections...
SQL injection in apache-superset
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue...