PYSEC-2023-104

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the runid parameter. This vulnerability is considered low since it requires an authenticated user to exploit i...

PYSEC-2023-103

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the...

CVE-2022-46651 Apache Airflow: Security vulnerability on AirFlow Connections

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the...

CVE-2022-46651 Apache Airflow: Security vulnerability on AirFlow Connections

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the...

Apache Airflow 输入验证错误漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is characterized by scalability and dynamic monitoring. An input validation error vulnerability exists in Apache Airflow versions prior to 2.6.3,...

Apache Airflow 安全漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security bypass vulnerability exists in Apache Airflow versions prior to 2.6.3,...

Apache Airflow 输入验证错误漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow versions prior to...

Apache Airflow 信息泄露漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions prior to...

Apache Airflow 路径遍历漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A path traversal vulnerability exists in Apache Airflow versions prior to 2.6.3,...

PT-2023-4800 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.6.3 Description: The issue exists due to insufficient input validation, allowing a remote attacker to cause a service disruption. This can be achieved by manipulating the run id parameter. The exploitation...

WordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Abstracts Type Plugin Vulnerable versions = 2.6.3 Fixed in 2.6.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28692 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d24a94d01c26 Credits qilin99 Required privilege...

CVE-2023-35925

FastAsyncWorldEdit FAWE is designed for efficient world editing. This vulnerability enables the attacker to select a region with the Infinity keyword case-sensitive! and executes any operation. This has a possibility of bringing the performing server down. This issue has been fixed in version 2.6...

Code injection

FastAsyncWorldEdit FAWE is designed for efficient world editing. This vulnerability enables the attacker to select a region with the Infinity keyword case-sensitive! and executes any operation. This has a possibility of bringing the performing server down. This issue has been fixed in version 2.6...

CVE-2023-35925 FastAsyncWorldEdit vulnerable to Uncontrolled Resource Consumption

FastAsyncWorldEdit FAWE is designed for efficient world editing. This vulnerability enables the attacker to select a region with the Infinity keyword case-sensitive! and executes any operation. This has a possibility of bringing the performing server down. This issue has been fixed in version 2.6...

CVE-2023-35925 FastAsyncWorldEdit vulnerable to Uncontrolled Resource Consumption

FastAsyncWorldEdit FAWE is designed for efficient world editing. This vulnerability enables the attacker to select a region with the Infinity keyword case-sensitive! and executes any operation. This has a possibility of bringing the performing server down. This issue has been fixed in version 2.6...

WordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Abstracts Type Plugin Vulnerable versions = 2.6.3 Fixed in 2.6.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-29385 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID eb9850af3b46 Credits LEE SE HYOUNG...

PT-2023-22429 · Mccms · Mccms

Name of the Vulnerable Software and Affected Versions: mccms version 2.6.3 Description: The issue is related to Cross Site Request Forgery CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application. No information is provided about the estimated...

CVE-2023-24002

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPdevart YouTube Embed, Playlist and Popup by WpDevArt plugin = 2.6.3 versions...

Security Bulletin: Moment js as used by IBM QRadar Advisor With Watson App is vulnerable to denial of service (CVE-2022-31129)

Summary Moment js as used by IBM QRadar Advisor With Watson App is vulnerable to denial of service. IBM has addressed the relevant vulnerabilities. Vulnerability Details CVEID:CVE-2022-31129 DESCRIPTION: Moment is vulnerable to a denial of service, caused by inefficient regular expression...

SUSE CVE-2022-21731

Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for ConcatV2 can be used to trigger a denial of service attack via a segfault caused by a type confusion. The axis argument is translated into concatdim in the ConcatShapeHelper helper function. Then, a...