Skip to content
Noroxi

OpenRefine records

15 published records for vendor openrefine.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
86.7%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 23
  4. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

15 records
  • CVE-2023-41887
    52Plan

    Remote Code exec in project import with mysql jdbc url attack

    CriticalCVSS 9.8No exploitEPSS 43%

    openrefine · openrefineSep 15, 2023

  • CVE-2024-47883
    36Monitor

    Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

    CriticalCVSS 9.1No exploitEPSS 2%

    openrefine · butterflyOct 24, 2024

  • CVE-2024-47881
    35Monitor

    OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)

    HighCVSS 8.8No exploitEPSS 1%

    openrefine · openrefineOct 24, 2024

  • CVE-2024-47879
    35Monitor

    OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    openrefine · openrefineOct 24, 2024

  • CVE-2019-3580
    31Monitor

    OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file.

    HighCVSS 7.5No exploitEPSS 2%

    openrefine · openrefineJan 2, 2019

  • CVE-2018-20157
    31Monitor

    The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing at

    HighCVSS 7.5No exploitEPSS 2%

    openrefine · openrefineDec 14, 2018

  • CVE-2023-37476
    31Monitor

    Zip slip in OpenRefine

    HighCVSS 7.8No exploitEPSS 1%

    openrefine · openrefineJul 17, 2023

  • CVE-2024-23833
    30Monitor

    OpenRefine JDBC Attack Vulnerability

    HighCVSS 7.5No exploitEPSS 1%

    openrefine · openrefineFeb 12, 2024

  • CVE-2023-41886
    30Monitor

    OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack

    HighCVSS 7.5No exploitEPSS 1%

    openrefine · openrefineSep 15, 2023

  • CVE-2018-19859
    27Monitor

    OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.

    MediumCVSS 6.5Proof of conceptEPSS 2%

    openrefine · openrefineDec 5, 2018

  • CVE-2024-47880
    27Monitor

    OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand

    MediumCVSS 6.9No exploitEPSS 0%

    openrefine · openrefineOct 24, 2024

  • CVE-2022-41401
    26Monitor

    OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, po

    MediumCVSS 6.5Proof of conceptEPSS 1%

    openrefine · openrefineAug 4, 2023

  • CVE-2024-47882
    24Monitor

    OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project

    MediumCVSS 6.1No exploitEPSS 0%

    openrefine · openrefineOct 24, 2024

  • CVE-2024-47878
    24Monitor

    Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)

    MediumCVSS 6.1No exploitEPSS 0%

    openrefine · openrefineOct 24, 2024

  • CVE-2024-49760
    21Monitor

    OpenRefine has a path traversal in LoadLanguageCommand

    MediumCVSS 5.3No exploitEPSS 1%

    openrefine · openrefineOct 24, 2024