428 matches found
Metabase GeoJSON API Local File Inclusion Vulnerability
Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data...
AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services
The threat actors behind the AndroxGh0st malware are now exploiting a broader set of security flaws impacting various internet-facing applications, while also deploying the Mozi botnet malware. "This botnet utilizes remote code execution and credential-stealing methods to maintain persistent...
Openfire SSRF (CVE-2019-18394)
The version of Openfire installed on the remote host is prior to 4.4.3. It is, therefore, affected by a server side request forgery vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. Note that Nessus has not tested...
Exploit for CVE-2023-38646
Exploit CVE-2023-38646 Metabase before 0.46.6.1 open source...
Metabase 0.46.6 - Pre-Auth Remote Code Execution Exploit
Exploit Title: metabase 0.46.6 - Pre-Auth Remote Code Execution Exploit Author: Musyoka Ian Vendor Homepage: https://www.metabase.com/ Software Link: https://www.metabase.com/ Version: metabase 0.46.6 Tested on: Ubuntu 22.04, metabase 0.46.6 CVE : CVE-2023-38646 !/usr/bin/env python3 import socke...
Metabase 0.46.6 - Pre-Auth Remote Code Execution
Exploit Title: metabase 0.46.6 - Pre-Auth Remote Code Execution Google Dork: N/A Date: 13-10-2023 Exploit Author: Musyoka Ian Vendor Homepage: https://www.metabase.com/ Software Link: https://www.metabase.com/ Version: metabase 0.46.6 Tested on: Ubuntu 22.04, metabase 0.46.6 CVE : CVE-2023-38646...
Metabase 0.46.6 Remote Code Execution
Exploit Title: metabase 0.46.6 - Pre-Auth Remote Code Execution Google Dork: N/A Date: 13-10-2023 Exploit Author: Musyoka Ian Vendor Homepage: https://www.metabase.com/ Software Link: https://www.metabase.com/ Version: metabase 0.46.6 Tested on: Ubuntu 22.04, metabase 0.46.6 CVE : CVE-2023-38646...
Metabase RCE (CVE-2023-38646)
The version of Metabase installed on the remote host is 0.46.x 0.46.6.1, 0.45.x 0.45.4.1, 1.45.x 1.45.4.1, 0.44.x 0.44.7.1, 1.44.x 1.44.7.1, 0.43.x 0.43.7.2, and 1.43.x 1.43.7.2. It is, therefore, affected by a command execution vulnerability when a malicious attacker sends a specially crafted...
Malicious code in metabase-enterprise (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36f82ac275d8bf6e50d44d5e69c1e30d070cf24d267d105aa88b8cf287583b43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-26 Malicious code in metabase-enterprise (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36f82ac275d8bf6e50d44d5e69c1e30d070cf24d267d105aa88b8cf287583b43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Exploit for CVE-2023-38646
CVE-2023-38646 Metabase Pre-Auth RCE 11/26/2023 Metabase ope...
The vulnerability of the Metabase data visualization and reporting software, related to deficiencies in authentication procedures, allows attackers to circumvent existing security restrictions and execute arbitrary code.
The vulnerability of the Metabase data visualization and reporting software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and execute arbitrary code remotely...
Metabase GeoJSON Remote Code Execution
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential RCE including environment variables because URLs were not validated prior to being loaded. No...
VulnCheck KEV: CVE-2023-38646
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1,...
Exploit for CVE-2023-38646
Metabase Pre-Auth RCE POC - CVE-2023-38646 Metabase open sourc...
Exploit for CVE-2023-38646
CVE-2023-38646 Python script to exploit CVE-2023-38646 Metabas...
Exploit for CVE-2023-38646
CVE-2023-38646 Python script to exploit CVE-2023-38646 Metabas...
Exploit for CVE-2023-38646
CVE-2023-38646 A python RCE exploit for CVE-2023-38646 Us...