460 matches found
Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...
CVE-2023-51702 Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...
CVE-2023-51702 Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...
PT-2024-14253
Name of the Vulnerable Software and Affected Versions Airflow versions 5.2.0 through 6.x Airflow versions 2.3.0 through 2.6.0 Description The Airflow worker serializes a Kubernetes configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption wh...
CVE-2024-22877
StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case reporting functionality. This feature allows an attacker to insert malicious JavaScript code inside the template or its variables, that will be executed in the context of the TheHive application when the HTML...
Cross site scripting
StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting XSS in the case attachment functionality which enables an attacker to upload a malicious HTML file with Javascript code that will be executed in the context of the The Hive application using a specific URL...
CVE-2024-22877
TheHive 5.2.0–5.2.8 is vulnerable to Cross-Site Scripting (XSS) in the case reporting feature. The issue allows an attacker to insert malicious JavaScript into the template or its variables, which executes in the TheHive application's context when the HTML report is opened. Root cause and exact i...
CVE-2023-6998
Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink before 5.2.0...
CVE-2023-6998
Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink before 5.2.0...
PT-2023-32834 · Ewelink · Ewelink
Name of the Vulnerable Software and Affected Versions: eWeLink versions prior to 5.2.0 Description: The issue is related to improper privilege management in the eWeLink application on Android and iOS, allowing for application lockscreen bypass. Recommendations: For versions prior to 5.2.0, update...
CVE-2023-27150
openCRX 5.2.0 was discovered to contain a cross-site scripting XSS vulnerability via the Name field after creation of a Tracker in Manage Activity...
Cross site scripting
openCRX 5.2.0 was discovered to contain a cross-site scripting XSS vulnerability via the Name field after creation of a Tracker in Manage Activity...
CVE-2023-27150
openCRX 5.2.0 was discovered to contain a cross-site scripting XSS vulnerability via the Name field after creation of a Tracker in Manage Activity...
CVE-2023-27150
OpenCRX 5.2.0 has a cross-site scripting (XSS) vulnerability in the Name field when creating a Tracker in Manage Activity. Root cause: input in the Name field is not properly sanitized, enabling script execution. Impact: potential client-side script execution affecting users of affected deploymen...
CVE-2023-27150
openCRX 5.2.0 was discovered to contain a cross-site scripting XSS vulnerability via the Name field after creation of a Tracker in Manage Activity...
CVE-2023-27150
openCRX 5.2.0 was discovered to contain a cross-site scripting XSS vulnerability via the Name field after creation of a Tracker in Manage Activity...
CVE-2023-27151
openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number in the Saved Search Activity via the Name, Description, or Activity Number field...
PT-2023-20976 · Opencrx · Opencrx
Name of the Vulnerable Software and Affected Versions: openCRX version 5.2.0 Description: A cross-site scripting XSS issue was discovered in openCRX, which occurs via the Name field after creating a Tracker in Manage Activity. This allows for potential malicious script execution. Recommendations:...