Skip to content
OpenAdvisories

Vendor

pinterest

4 known vulnerabilities.

Products

querybook 4
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.6
    CVE-2024-28251

    Cross-site websocket hijacking in Querybook

    Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality works by using a Websocket Server. The client talks to this WSS whenever updating/deleting/reading any cells as well a…

    pinterest querybook
  • Medium 6.1
    CVE-2024-27103

    Querybook Stored Cross-Site Scripting allows Privilege Elevation

    Querybook is a Big Data Querying UI. When a user searches for their queries, datadocs, tables and lists, the search result is marked and highlighted, and this feature uses dangerouslySetInnerHTML which means that if the highlighted result has an XSS payload i…

    pinterest querybook
  • Medium 6.1
    CVE-2024-26148

    Querybook's Stored Cross-Site Scripting vulnerability allows Privilege Elevation

    Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to input arbitrary URLs without undergoing necessary validation. This particular security flaw allows the…

    pinterest querybook
  • Medium 6.3
    CVE-2022-46151

    Reflected XSS

    Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/server/app/auth/oauth_auth.py` and `querybook/server/app/auth/okta_auth.py`. This may allow attacker…

    pinterest querybook