Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
to bypass security features or execute arbitrary code. The implementation of `ux_device_class_dfu_control_request` function prevents buffer overflow during handling of DFU UPLOAD command when current state is `UX_SYSTEM_DFU_STATE_DFU_IDLE`. This issue has been patched, please upgrade to version 6.1.12. As a workaround, add the `UPLOAD_LENGTH` check in all possible states. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/azure-rtos/usbx/security/advisories/GHSA-m9p8-xrp7-vvqp
CVE ID: CVE-2022-39345 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-04-22T17:17:16.782Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: flipped-aurora Products: gin-vue-admin Problem Types: CWE-22, CWE-23 Description: Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
s aside from upgrading to a patched version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv - https://github.com/flipped-aurora/gin-vue-admin/issues/1263 - https://github.com/flipped-aurora/gin-vue-admin/pull/1264 - https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go
CVE ID: CVE-2022-39346 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-23T16:34:56.234Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-400, CWE-20 Description: Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container:
10, 23.0.7 or 24.0.3. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6w9f-jgjx-4vj6 - https://github.com/nextcloud/server/pull/33052 - https://hackerone.com/reports/1588562 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TARDPRPBTI5TJRBYRVVQGTL6KWRCV5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRAER4DCCHHSUDFHQ6LTIH4JEJFF73IU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messag
SUDFHQ6LTIH4JEJFF73IU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R32L3P53AQKQQC652LA5U3AWFTZKPDK3/
CVE ID: CVE-2022-39347 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-11-03T20:35:05.619Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-22 Description: FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP based client to read files outside the shared directory. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or `+home-drive` redirection switc
re advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or `+home-drive` redirection switch. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5xq-8v35-pffg - https://github.com/FreeRDP/FreeRDP/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/ - https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html - https://securit
YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/ - https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html - https://security.gentoo.org/glsa/202401-16
CVE ID: CVE-2022-39348 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-11-03T21:46:32.067Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: twisted Products: twisted Problem Types: CWE-80, CWE-79 Description: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request i
In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 - https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b - https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4 - https://lists.debian.org/debian-lts-announce/2022/11/msg00038.html - https://security.gentoo.org/glsa/202301-02
CVE ID: CVE-2022-39349 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-04-23T16:43:58.446Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: tasks Products: tasks Problem Types: CWE-441, CWE-668 Description: The Tasks.org Android app is an open-source app for to-do lists and reminders. The Tasks.org app uses the activity `ShareLinkActivity.kt` to handle "share" intents coming from other components in the same device and convert them to tasks. Those intents may contain arbitrary file paths as attachments, in which case the files pointed by those paths are copied in the app's external storage directory. Prior to versions 12.7.1 and 13.0.1
the files pointed by those paths are copied in the app's external storage directory. Prior to versions 12.7.1 and 13.0.1, those paths were not validated, allowing a malicious or compromised application in the same device to force Tasks.org to copy files from its internal storage to its external storage directory, where they became accessible to any component with permission to read the external storage. This vulnerability can lead to sensitive information disclosure. All information in the user's notes and the app's preferences, including the encrypted credentials of CalDav integrations if enabled, could be accessed by third party applications installed on the same device. This issue was fix
integrations if enabled, could be accessed by third party applications installed on the same device. This issue was fixed in versions 12.7.1 and 13.0.1. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tasks/tasks/security/advisories/GHSA-8x58-cg74-8jg8 - https://github.com/tasks/tasks/commit/23bf69d3f44b07e4bc62ea107f72103239f5d942
CVE ID: CVE-2022-39350 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-04-23T16:43:52.344Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: DependencyTrack Products: frontend Problem Types: CWE-79 Description: @dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the Dependency-Track frontend renders them using the JavaScript library Showdown. Showdown does not have any XSS countermeasures built in
ack frontend renders them using the JavaScript library Showdown. Showdown does not have any XSS countermeasures built in, and versions before 4.6.1 of the Dependency-Track frontend did not encode or sanitize Showdown's output. This made it possible for arbitrary JavaScript included in vulnerability details via HTML attributes to be executed in context of the frontend. Actors with the `VULNERABILITY_MANAGEMENT` permission can exploit this weakness by creating or editing a custom vulnerability and providing XSS payloads in any of the following fields: Description, Details, Recommendation, or References. The payload will be executed for users with the `VIEW_PORTFOLIO` permission when browsing t
commendation, or References. The payload will be executed for users with the `VIEW_PORTFOLIO` permission when browsing to the modified vulnerability's page. Alternatively, malicious JavaScript could be introduced via any of the vulnerability databases mirrored by Dependency-Track. However, this attack vector is highly unlikely, and the maintainers of Dependency-Track are not aware of any occurrence of this happening. Note that the `Vulnerability Details` element of the `Audit Vulnerabilities` tab in the project view is not affected. The issue has been fixed in frontend version 4.6.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/
ion 4.6.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DependencyTrack/frontend/security/advisories/GHSA-c33w-pm52-mqvf - https://docs.dependencytrack.org/changelog/ - https://github.com/showdownjs/showdown/wiki/Markdown%27s-XSS-Vulnerability-%28and-how-to-mitigate-it%29
CVE ID: CVE-2022-39351 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-04-23T16:43:44.094Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: DependencyTrack Products: dependency-track Problem Types: CWE-312 Description: Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit log in clear text. Actors with access to the audit log can exploit this flaw to gain access to valid API keys. The issue has be
clear text. Actors with access to the audit log can exploit this flaw to gain access to valid API keys. The issue has been fixed in Dependency-Track 4.6.0. Instead of logging the entire API key, only the last 4 characters of the key will be logged. It is strongly recommended to check historic logs for occurrences of this behavior, and re-generating API keys in case of leakage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.dependencytrack.org/changelog/ - https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-gh7v-4hxp-gqp4 - https://github.com/DependencyTrack/dependency-track/blob/4.5.0/src/main/docker/logback.xml
CVE ID: CVE-2022-39352 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-04-23T16:39:59.732Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: openfga Products: openfga Problem Types: CWE-863 Description: OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under certain conditions. You are affected by this vulnerability if you added a tuple with a wildcard (*) assigned to a tupleset relation (the right hand side of a ‘from’ statement). This issue has been patched in version v0.2.5. This update is not backward compatible with any authoriza
om’ statement). This issue has been patched in version v0.2.5. This update is not backward compatible with any authorization model that uses wildcard on a tupleset relation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openfga/openfga/security/advisories/GHSA-3gfj-fxx4-f22w
CVE ID: CVE-2022-39353 State: PUBLISHED Published: 2022-11-02T00:00:00.000Z Last Updated: 2025-04-22T17:16:38.092Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: xmldom Products: xmldom Problem Types: CWE-20, CWE-1288 Description: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-3929
ng. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883 - http
: - CISA ADP Vulnrichment: References: - https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883 - https://github.com/jindw/xmldom/issues/150 - https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html
CVE ID: CVE-2022-39354 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-04-23T16:43:37.219Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: rust-blockchain Products: evm Problem Types: CWE-670 Description: SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the `is_static` parameter to determine if the call is executed in a static context (via `STATICCALL`), and thus decide if stateful operations should be done. Prior to version 0.36.0, the passed `is_static` parameter was incorrect -- it was only set to `true` if the call came from a direct `STATICCALL` opcode. However
static` parameter was incorrect -- it was only set to `true` if the call came from a direct `STATICCALL` opcode. However, once a static call context is entered, it should stay static. The issue only impacts custom precompiles that actually uses `is_static`. For those affected, the issue can lead to possible incorrect state transitions. Version 0.36.0 contains a patch. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rust-blockchain/evm/security/advisories/GHSA-hhc4-47rh-cr34 - https://github.com/rust-blockchain/evm/pull/133
CVE ID: CVE-2022-39355 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-04-23T16:43:09.263Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: discourse Products: discourse-patreon Problem Types: CWE-287 Description: Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim's forum account. This vulnerability is patched in commit number 846d012151514b35ce42a1636c7d70f6dcee879e of the discourse-patreon plugin. Out of an abundance of caution, any Discourse accounts which have logged in with a
879e of the discourse-patreon plugin. Out of an abundance of caution, any Discourse accounts which have logged in with an unverified-email Patreon account will be logged out and asked to verify their email address on their next login. As a workaround, disable the patreon integration and log out all users with associated Patreon accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse-patreon/security/advisories/GHSA-fvj9-f67v-qpr4 - https://github.com/discourse/discourse-patreon/commit/846d012151514b35ce42a1636c7d70f6dcee879e
CVE ID: CVE-2022-39356 State: PUBLISHED Published: 2022-11-02T00:00:00.000Z Last Updated: 2025-04-23T16:41:45.660Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: discourse Products: discourse Problem Types: CWE-285 Description: Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can enter any non-admin user's email and gain access to their account when accepting the invitation. All users should upgrade to the latest version. A workaround is temporarily disabling invitations with `SiteSetting.max_invites_per_day = 0` or scope them to individual email addresses. Additional Analyst N
invitations with `SiteSetting.max_invites_per_day = 0` or scope them to individual email addresses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-x8w7-rwmr-w278 - https://github.com/discourse/discourse/pull/18817
CVE ID: CVE-2022-39357 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-04-23T16:43:01.718Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wintercms Products: winter Problem Types: CWE-1321 Description: Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by followin
oard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by following some common security practices for JavaScript, including implementing a content security policy and auditing scripts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wintercms/winter/security/advisories/GHSA-3fh5-q6fg-w28q - https://github.com/wintercms/winter/commit/2a13faf99972e84c9661258f16c4750fa99d29a1 - https://github.com/wintercms/winter/commit/bce4b59584abf961e9400af3d7a4fd7638e26c7f - https://github.com/wintercms/winter/releases/tag/v1.1.10 - https://github.com/wintercms/winter/releases/tag/v1.2.1
CVE ID: CVE-2022-39358 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-04-23T16:42:54.892Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: metabase Products: metabase Problem Types: CWE-200 Description: Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-8qgm-9mj6-36h3
CVE ID: CVE-2022-39359 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-04-23T16:42:47.570Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: metabase Products: metabase Problem Types: CWE-200 Description: Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment var
1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow redirects on GeoJSON map URLs. An environment variable `MB_CUSTOM_GEOJSON_ENABLED` was also added to disable custom GeoJSON completely (`true` by default). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-w5j7-4mgm-77f4 - https://github.com/metabase/metabase/commit/057e2d67fcbeb6b48db68b697e022243e3a5771e
CVE ID: CVE-2022-39360 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-04-23T16:42:39.520Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: metabase Products: metabase Problem Types: CWE-304, CWE-287 Description: Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase now blocks password reset for all users who use SSO fo
4.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase now blocks password reset for all users who use SSO for their Metabase login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-gw4g-ww2m-v7vc - https://github.com/metabase/metabase/commit/edadf7303c3b068609f57ca073e67885d5c98730
CVE ID: CVE-2022-39361 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-04-23T16:42:33.265Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: metabase Products: metabase Problem Types: CWE-20, CWE-441 Description: Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow Remote Code Execution (RCE), which can be abused by users able to write SQL queries on H2 databases. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer allows DDL statements in H2 native queries. Additio
43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer allows DDL statements in H2 native queries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-gqpj-wcr3-p88v
CVE ID: CVE-2022-39362 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-04-23T16:42:26.901Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: metabase Products: metabase Problem Types: CWE-356 Description: Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer automatically executes ad-hoc native queries. Now the native editor shows the query and gives the user the opti