Vulnerabilities > Apache

DATE CVE VULNERABILITY TITLE RISK
2023-01-16 CVE-2022-41703 SQL Injection vulnerability in Apache Superset
A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value).
network
low complexity
apache CWE-89
5.4
2023-01-16 CVE-2022-43717 Unspecified vulnerability in Apache Superset
Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
network
low complexity
apache
5.4
2023-01-16 CVE-2022-43718 Unspecified vulnerability in Apache Superset
Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
network
low complexity
apache
5.4
2023-01-16 CVE-2022-43719 Unspecified vulnerability in Apache Superset
Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery.
network
low complexity
apache
8.8
2023-01-16 CVE-2022-43720 Unspecified vulnerability in Apache Superset
An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
network
low complexity
apache
5.4
2023-01-16 CVE-2022-43721 Unspecified vulnerability in Apache Superset
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
network
low complexity
apache
5.4
2023-01-16 CVE-2022-45438 Unspecified vulnerability in Apache Superset
When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
network
low complexity
apache
5.3
2023-01-14 CVE-2023-22602 When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques.
network
low complexity
apache vmware
7.5
2023-01-09 CVE-2022-46769 Unspecified vulnerability in Apache Sling CMS
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature. Upgrade to Apache Sling App CMS >= 1.1.4
network
low complexity
apache
5.4
2023-01-06 CVE-2022-45787 Unspecified vulnerability in Apache James
Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users.
local
low complexity
apache
5.5