| CVE-2024-23952 |
This is a duplicate for CVE-2023-46104
|
6.5
Medium
|
Feb 14, 2024 |
| CVE-2023-49657 |
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with…
|
9.6
Critical
|
Jan 23, 2024 |
| CVE-2023-49734 |
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically…
|
7.7
High
|
Dec 19, 2023 |
| CVE-2023-49736 |
A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow…
|
6.5
Medium
|
Dec 19, 2023 |
| CVE-2023-46104 |
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import…
|
6.5
Medium
|
Dec 19, 2023 |
| CVE-2023-42504 |
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports,…
|
5.8
Medium
|
Nov 28, 2023 |
| CVE-2023-42505 |
An authenticated user with read permissions on database connections metadata could potentially access sensitive…
|
4.3
Medium
|
Nov 28, 2023 |
| CVE-2023-42502 |
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing…
|
4.8
Medium
|
Nov 28, 2023 |
| CVE-2023-43701 |
Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious…
|
4.3
Medium
|
Nov 27, 2023 |
| CVE-2023-42501 |
Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates…
|
4.3
Medium
|
Nov 27, 2023 |
| CVE-2023-40610 |
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2
|
6.3
Medium
|
Nov 27, 2023 |
| CVE-2023-32672 |
An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0
|
4.3
Medium
|
Sep 6, 2023 |
| CVE-2023-37941 |
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted…
|
6.6
Medium
|
Sep 6, 2023 |
| CVE-2023-39265 |
Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses…
|
3.8
Low
|
Sep 6, 2023 |
| CVE-2023-39264 |
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API…
|
4.3
Medium
|
Sep 6, 2023 |
| CVE-2023-27523 |
Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for…
|
5.0
Medium
|
Sep 6, 2023 |
| CVE-2023-36388 |
Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to…
|
4.3
Medium
|
Sep 6, 2023 |
| CVE-2023-27526 |
A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up…
|
4.3
Medium
|
Sep 6, 2023 |
| CVE-2023-36387 |
An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an…
|
5.4
Medium
|
Sep 6, 2023 |
| CVE-2023-30776 |
An authenticated user with specific data permissions could access database connections stored passwords by requesting…
|
4.9
Medium
|
Apr 24, 2023 |
| CVE-2023-27524 |
Exploited
Apache Superset Insecure Default Initialization of Resource Vulnerability
|
8.9
High
|
Apr 24, 2023 |
| CVE-2023-25504 |
A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import…
|
4.9
Medium
|
Apr 17, 2023 |
| CVE-2023-27525 |
An authenticated user with Gamma role authorization could have access to metadata information using non trivial…
|
3.1
Low
|
Apr 17, 2023 |
| CVE-2022-41703 |
A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a…
|
Not rated
|
Jan 16, 2023 |
| CVE-2022-45438 |
When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an…
|
Not rated
|
Jan 16, 2023 |