CVE-2022-24853

CVE-2022-24853 Metabase NTLM リフレクション / リレー攻撃 CVE-2022-24853 発見に関するブログ記事: https://secure77.de/metabase-ntlm-relay-attack/ Github セキュリティアドバイザリ: https://github.com/metabase/metabase/security/advisories/GHSA-5cfq-582c-c38m POC root@kitploit:...

EUVD-2025-14803

Malicious code in bioql PyPI...

EUVD-2022-46746

Malicious code in bioql PyPI...

Metabase < 0.44.5

The version of Metabase installed on the remote host is prior to 0.44.5. It is, therefore, affected by a The url parameter of the /api/geojson endpoint in Metabase versions 0.44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented b...

CVE-2025-30371

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...

CVE-2025-30371

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...

CVE-2025-30371 Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...

CVE-2025-30371 Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...

CVE-2025-30371

CVE-2025-30371 affects Metabase (self-hosted) prior to versions v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. The issue is a circumvention of local link access protection in the GeoJson endpoint, potentially impacting deployments where Metabase is colocated with other unsecured resources. Remedia...

CVE-2025-30371 Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...

Metabase 后置链接漏洞

Metabase is an open source data analytics platform from the US-based Metabase, Inc. A backlink vulnerability exists in Metabase versions prior to v0.52.16.4, prior to v1.52.16.4, prior to v0.53.8, and prior to v1.53.8, which stems from a bypass of the GeoJson endpoint local link access protection...

CVE-2025-30371: Improper Link Resolution Before File Access

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...

Metabase 代码问题漏洞

Metabase is an open source data analytics platform from the US-based Metabase Inc. A security vulnerability exists in Metabase versions prior to 44.5, which stems from the /api/geojson endpoint's url parameter can be used to perform a server-side request forgery attack that utilizes 301 and 302...

PT-2022-27030 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 44.5 Description: The issue concerns the url parameter of the "/api/geojson" endpoint, which can be exploited to perform Server Side Request Forgery attacks. It is noted that previously implemented blacklists could ...

PT-2021-23236 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.40.5 Metabase versions prior to 1.40.5 Description: A security issue has been discovered in Metabase, an open source data analytics platform, related to the custom GeoJSON map support and potential local file...