Apache / Apache Superset
65 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2024-23952 | Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104) | MEDIUM | 6.5 | Feb 14, 2024 |
| CVE-2023-49657 | Apache Superset: Stored XSS in Dashboard Title and Chart Title | CRITICAL | 9.6 | Jan 23, 2024 |
| CVE-2023-49734 | Apache Superset: Privilege Escalation Vulnerability | HIGH | 7.7 | Dec 19, 2023 |
| CVE-2023-49736 | Apache Superset: SQL Injection on where_in JINJA macro | HIGH | 8.8 | Dec 19, 2023 |
| CVE-2023-46104 | Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb | MEDIUM | 6.5 | Dec 19, 2023 |
| CVE-2023-42504 | Apache Superset: Lack of rate limiting allows for possible denial of service | MEDIUM | 6.5 | Nov 28, 2023 |
| CVE-2023-42505 | Apache Superset: Sensitive information disclosure on db connection details | MEDIUM | 4.3 | Nov 28, 2023 |
| CVE-2023-42502 | Apache Superset: Open Redirect Vulnerability | MEDIUM | 5.4 | Nov 28, 2023 |
| CVE-2023-43701 | Apache Superset: Stored XSS on API endpoint | MEDIUM | 5.4 | Nov 27, 2023 |
| CVE-2023-42501 | Apache Superset: Unnecessary read permissions within the Gamma role | MEDIUM | 4.3 | Nov 27, 2023 |
| CVE-2023-40610 | Apache Superset: Privilege escalation with default examples database | HIGH | 8.8 | Nov 27, 2023 |
| CVE-2023-32672 | Apache Superset: SQL parser edge case bypasses data access authorization | MEDIUM | 4.3 | Sep 6, 2023 |
| CVE-2023-37941 | Apache Superset: Metadata db write access can lead to remote code execution | MEDIUM | 6.6 | Sep 6, 2023 |
| CVE-2023-39265 | Apache Superset: Possible Unauthorized Registration of SQLite Database Connections | MEDIUM | 6.5 | Sep 6, 2023 |
| CVE-2023-39264 | Apache Superset: Stack traces enabled by default | MEDIUM | 4.3 | Sep 6, 2023 |
| CVE-2023-27523 | Apache Superset: Improper data permission validation on Jinja templated queries | MEDIUM | 5.0 | Sep 6, 2023 |
| CVE-2023-36388 | Apache Superset: Improper API permission for low privilege users allows for SSRF | MEDIUM | 5.4 | Sep 6, 2023 |
| CVE-2023-27526 | Apache Superset: Improper Authorization check on import charts | MEDIUM | 4.3 | Sep 6, 2023 |
| CVE-2023-36387 | Apache Superset: Improper API permission for low privilege users | MEDIUM | 5.4 | Sep 6, 2023 |
| CVE-2023-30776 | Apache Superset: Database connection password leak | MEDIUM | 6.5 | Apr 24, 2023 |
| CVE-2023-27524 KEV | Apache Superset: Session validation vulnerability when using provided default SECRET_KEY | CRITICAL | 9.8 | Apr 24, 2023 |
| CVE-2023-25504 | Apache Superset: Possible SSRF on import datasets | MEDIUM | 6.5 | Apr 17, 2023 |
| CVE-2023-27525 | Apache Superset: Incorrect default permissions for Gamma role | MEDIUM | 4.3 | Apr 17, 2023 |
| CVE-2022-41703 | Apache Superset: SQL injection vulnerability in adhoc clauses | MEDIUM | 5.4 | Jan 16, 2023 |
| CVE-2022-45438 | Apache Superset: Dashboard metadata information leak | MEDIUM | 5.3 | Jan 16, 2023 |
Showing 26 to 50 of 65 CVEs