CVE-2023-37941

Superset 기본 캐시 내 Pickle RCE 악용 정보 저자 Dinis Cruz 프로젝트 Superset 설명 Apache Superset는 캐싱을 위한 여러 옵션을 제공하며, 모두 Flask-Caching을 기반으로 합니다. 내장 캐시는 값을 나중에 검색하기 위해 직렬화합니다. 이 직렬화 및 검색은 Pickle을 사용하여 수행되며, 이는 Python 객체의 역직렬화를 허용하여 코드 실행으로 이어집니다. 내장 캐시는 메타데이터 데이터베이스에 정보를 기록하며, 이는 이 데이터베이스에 접근할 수 있는 공격자가 권한을 상승시키...

Apache Superset Deserialization of Untrusted Data vulnerability

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by t...

PYSEC-2026-1175 Apache Superset Deserialization of Untrusted Data vulnerability

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by t...

PT-2026-53596

Summary A SQL injection vulnerability in FilterEngine.create postgres query allows any authenticated Rucio user to execute arbitrary SQL against the configured PostgreSQL metadata database through the DID search endpoint GET /dids//dids/search. When the external metadata plugin postgres meta is...

📄 Discuz! X5.0 Local File Inclusion

This is a Metasploit auxiliary module targeting a local file inclusion vulnerability in Discuz! X5.0. ================================================================================================================================== | Title : Discuz! X5.0 LFI Metasploit Module | | Author :...

CVE-2026-29090

Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in FilterEngine.createpostgresquery. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoin...

CVE-2026-29090 Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database

Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in FilterEngine.createpostgresquery. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoin...

CVE-2026-29090

Rucio contains a SQL injection in FilterEngine.create_postgres_query() when the postgres_meta metadata plugin is configured. Attacker-controlled filter keys/values are interpolated into raw SQL via Python .format() and passed to psycopg3.sql.SQL(), enabling arbitrary SQL against the PostgreSQL me...

Rucio SQL注入漏洞

Rucio is an open-source scientific data management tool developed by Rucio team. Rucio has a SQL injection vulnerability, which stems from the SQL injection in the FilterEngine.createpostgresquery method. This vulnerability allows any authenticated Rucio user to execute arbitrary SQL queries...

EUVD-2019-0017

Malware in sbrugna...

EUVD-2023-2955

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2018-12088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the backend can present old versions of the...

VulnCheck KEV: CVE-2023-37941

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by t...

CVE-2021-36372

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked...

CVE-2023-37941

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by t...

BIT-SUPERSET-2023-37941 Apache Superset: Metadata db write access can lead to remote code execution

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by t...

RLSA-2023:7712 Important: tracker-miners security update

Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tracker. Security Fixes: tracker-miners: sandbox escape CVE-2023-5557 For more details about the security issues, including th...

Important: Red Hat Security Advisory: tracker-miners security update

An update for tracker-miners is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: tracker-miners security update

An update for tracker-miners is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a...

Duplicate Advisory: Apache Superset - Elevation of Privilege

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f678-j579-4xf5. This link is maintained to preserve external references. Original Description Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using th...