| CVE-2022-43721 |
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users…
|
Not rated
|
Jan 16, 2023 |
| CVE-2022-43720 |
An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will…
|
Not rated
|
Jan 16, 2023 |
| CVE-2022-43719 |
Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery
|
Not rated
|
Jan 16, 2023 |
| CVE-2022-43718 |
Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by…
|
Not rated
|
Jan 16, 2023 |
| CVE-2022-43717 |
Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack…
|
Not rated
|
Jan 16, 2023 |
| CVE-2021-37839 |
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have…
|
Not rated
|
Jul 6, 2022 |
| CVE-2022-27479 |
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests
|
Not rated
|
Apr 13, 2022 |
| CVE-2021-44451 |
Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated…
|
Not rated
|
Feb 1, 2022 |
| CVE-2021-42250 |
Improper output neutralization for Logs
|
Not rated
|
Nov 17, 2021 |
| CVE-2021-41972 |
Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users
|
Not rated
|
Nov 12, 2021 |
| CVE-2021-41971 |
Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default)…
|
Not rated
|
Oct 18, 2021 |
| CVE-2021-32609 |
Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page
|
Not rated
|
Oct 18, 2021 |
| CVE-2021-28125 |
Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious
|
Not rated
|
Apr 27, 2021 |
| CVE-2021-27907 |
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for…
|
Not rated
|
Mar 5, 2021 |
| CVE-2020-1932 |
An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1
|
Not rated
|
Jan 28, 2020 |