Homepage
About Snyk

redash@0.16.0 vulnerabilities

A better Standard Library for JavaScript

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the redash package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
LDAP Injection

redash is an A better Standard Library for JavaScript

Affected versions of this package are vulnerable to LDAP Injection. Redash is affected by LDAP Injection. There is an authentication bypass and information leak through the crafting of special queries, escaping the provided template because the ldap_user = auth_ldap_user(request.form["email"], request.form["password"]) auth_ldap_user(username, password) settings.LDAP_SEARCH_TEMPLATE % {"username": username} code lacks sanitization.

How to fix LDAP Injection?

There is no fixed version for redash.

*
  • H
Server-side Request Forgery (SSRF)

redash is an A better Standard Library for JavaScript

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the JSON data source. Possibly, other connectors are affected. The SSRF is potent and provides a lot of flexibility in terms of being able to craft HTTP requests e.g., by adding headers, selecting any HTTP verb, etc.

How to fix Server-side Request Forgery (SSRF)?

There is no fixed version for redash.

*
Go back to all versions of this package