TI-2023-22279 CVE-2023-41887 · GHSA-p3r5-x3hr-gpg5
Remote Code exec in project import with mysql jdbc url attack
Priority HIGH 82
OpenRefine is a powerful free, open source tool for working with messy data.
OpenRefine
Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9
Exploited now
OpenRefine records in CISA KEVNo OpenRefine vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
14 records in Openrefine · all components
TI-2024-32135 CVE-2024-47881 · GHSA-87cf-j763-vvh8
OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)
Priority HIGH 73
OpenRefine is a free, open source tool for working with messy data.
TI-2024-32133 CVE-2024-47879 · GHSA-3jm4-c6qf-jrh3
OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)
Priority HIGH 73
OpenRefine is a free, open source tool for working with messy data.
TI-2023-22278 CVE-2023-41886 · GHSA-qqh2-wvmv-h72m
OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack
Priority HIGH 72
OpenRefine is a powerful free, open source tool for working with messy data.
TI-2024-32134 CVE-2024-47880 · GHSA-79jv-5226-783f
OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand
Priority HIGH 70
OpenRefine is a free, open source tool for working with messy data.
TI-2024-32132 CVE-2024-47878 · GHSA-pw3x-c5vp-mfc3
Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)
Priority HIGH 70
OpenRefine is a free, open source tool for working with messy data.
TI-2022-19866 CVE-2022-41401 · GHSA-q7mc-fc87-v7w7
OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which…
Priority MEDIUM 62
OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive fil…
TI-2024-32136 CVE-2024-47882 · GHSA-j8hp-f2mj-586g
OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project
Priority MEDIUM 60
OpenRefine is a free, open source tool for working with messy data.
TI-2024-15827 CVE-2024-23833 · GHSA-6p92-qfqf-qwx4
OpenRefine JDBC Attack Vulnerability
Priority MEDIUM 41
OpenRefine is a free, open source power tool for working with messy data and improving it.
TI-2019-02645 CVE-2019-3580 · GHSA-wwhw-3q8v-6m46
OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur…
Priority LOW 37
OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file.
TI-2018-14281 CVE-2018-20157 · GHSA-q3w8-xp79-mqph
The data import functionality in OpenRefine through 3.1 allows an XML External Entity…
Priority LOW 36
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
TI-2023-19084 CVE-2023-37476 · GHSA-m88m-crr9-jvqq
Zip slip in OpenRefine
Priority LOW 35
OpenRefine is a free, open source tool for data processing.
TI-2018-14068 CVE-2018-19859 · GHSA-f6fv-fjg8-4m6w
OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.
Priority LOW 33
OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.
TI-2024-33227 CVE-2024-49760 · GHSA-qfwq-6jh6-8xx4
OpenRefine has a path traversal in LoadLanguageCommand
Priority LOW 32
OpenRefine is a free, open source tool for working with messy data.