84 matches found
CVE-2021-21239
Informe Técnico sobre CVE-2021-21239: Vulnerabilidad de Autenticación SAML en Redash Introducción a SAML Security Assertion Markup Language SAML es un estándar abierto para intercambiar datos de autenticación y autorización entre partes en un sistema de identidad federada. Permite el inicio de...
Redash Setup Configuration - Default Secrets Disclosure
Redash Setup Configuration is vulnerable to default secrets disclosure Insecure Default Initialization of Resource. If an admin sets up Redash versions =10.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both...
redash-reset
redash-reset This will use a default REDASHSECRETKEY key of c292a0a3aa32397cdb050e233733900f this allows you to reset the password of the user ID but you will need to know the email address assocaited with it. Info https://github.com/getredash/redash/security/advisories/GHSA-g8xr-f424-h2rv Setup...
redash-vulnerable
redash-vulnerable 🐛 Una instancia de Redash dockerizada que es vulnerable a CVE-2021-21239 según lo escrito por Calif. Uso 💻 Iniciar el servidor preservando datos script/server Esto iniciará el servidor Redash usando Docker Compose en modo detached, preservando cualquier dato existente. El servid...
CVE-2026-33213
Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the getnextpath function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as...
CVE-2026-33213 Redash: Open redirect vulnerability in post-login redirect handling
Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the getnextpath function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as...
CVE-2026-33213 Redash: Open redirect vulnerability in post-login redirect handling
Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the getnextpath function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as...
EUVD-2026-44686
Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the getnextpath function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as...
CVE-2026-33213 Redash: Open redirect vulnerability in post-login redirect handling
Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the getnextpath function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as...
CVE-2026-33213
Redash vulnerability CVE-2026-33213 affects the data-visualization tool Redash (versions 5.0.2 through 26.3.0). The get_next_path() function in the authentication module strips the scheme and netloc from user-supplied next parameters but does not normalize multiple leading slashes, enabling an op...
PT-2026-60177
Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get next path function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as...
CVE-2026-33213: URL Redirection to Untrusted Site
Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the getnextpath function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as...
📄 Redash 25.8.0 Password Hash Extraction
This PHP script is a security exploitation tool that targets Redash, an open-source data visualization platform. The tool leverages a configuration vulnerability in Redash's default PostgreSQL setup to perform two critical attacks. It can execute arbitrary system commands on the database server...
CVE-2020-12725
Havoc Research discovered an authenticated Server-Side Request Forgery SSRF via the "JSON" data source of Redash open-source 8.0.0 and prior. Possibly, other connectors are affected. The SSRF is potent and provides a lot of flexibility in terms of being able to craft HTTP requests e.g., by adding...
📄 Redash Authenticated Remote Command Execution
Redash’s default setup uses PostgreSQL superuser credentials for its primary data source. Because users can run SQL through Redash, any authenticated account gains excessive control over the database. This allows executing system commands on the database server through PostgreSQL’s COPY FROM...
EUVD-2020-23722
Malware in sbrugna...
EUVD-2020-5013
Malware in sbrugna...
EUVD-2025-17453
Malicious code in bioql PyPI...