CVE-2024-49760 | High | 7.1 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of t… |
CVE-2024-47883 | Critical | 9.1 | 2024-10-24 | The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the `java.net.URL` class to refer t… |
CVE-2024-47882 | Medium | 5.9 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the except… |
CVE-2024-47881 | High | 8.1 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the `database` extension, the "… |
CVE-2024-47880 | High | 8.1 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a way that it reflect… |
CVE-2024-47879 | High | 7.6 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expre… |
CVE-2024-47878 | High | 8.1 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET… |
CVE-2024-23833 | High | 7.5 | 2024-02-12 | OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) whe… |
CVE-2023-41887 | Critical | 9.8 | 2023-09-15 | OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthent… |
CVE-2023-41886 | High | 7.5 | 2023-09-15 | OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenti… |
CVE-2022-41401 | Medium | 6.5 | 2023-08-04 | OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading t… |
CVE-2023-37476 | Medium | 5.5 | 2023-07-17 | OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code exe… |
CVE-2019-3580 | High | 7.5 | 2019-01-03 | OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file. |
CVE-2018-20157 | High | 7.5 | 2018-12-15 | The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arb… |
CVE-2018-19859 | Medium | 6.5 | 2018-12-05 | OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive. |