Lucene search
+L

3283 matches found

CNNVD
CNNVD
added 2021/09/09 12:00 a.m.11 views

Apache Airflow 访问控制错误漏洞

Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform is scalable and dynamically monitored. Apache Airflow is vulnerable to an authorization issue that stems from a lack of authorization protection on the product's...

9.8CVSS6AI score0.80938EPSS
SaveExploits2References3
Github Security Blog
Github Security Blog
added 2021/08/30 4:25 p.m.69 views

Missing Authorization in Apache Airflow

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

5.3CVSS6AI score0.04022EPSS
SaveExploits0References8Affected Software1
OSV
OSV
added 2021/08/30 4:25 p.m.4 views

GHSA-M6H2-JX9V-58W6 Missing Authorization in Apache Airflow

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

5.3CVSS6.5AI score0.04022EPSS
SaveExploits0References9
Veracode
Veracode
added 2021/08/17 4:08 a.m.13 views

Information Disclosure

apache-airflow is vulnerable to information disclosure. The logging server running on port 0.0.0.0 by default has no authentication and allows reading log files of DAG jobs...

5.3CVSS6.5AI score0.04022EPSS
SaveExploits0References1Affected Software1
OSV
OSV
added 2021/08/16 8:15 a.m.27 views

CVE-2021-35936

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

5.3CVSS7AI score
SaveExploits0References1
NVD
NVD
added 2021/08/16 8:15 a.m.23 views

CVE-2021-35936

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

5.3CVSS0.04022EPSS
SaveExploits0References1
OSV
OSV
added 2021/08/16 8:15 a.m.9 views

PYSEC-2021-122

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

5.3CVSS6.5AI score0.04022EPSS
SaveExploits0References2
PyPA
PyPA
added 2021/08/16 8:15 a.m.10 views

PYSEC-2021-122

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

5.3CVSS7.3AI score0.04022EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2021/08/16 8:15 a.m.20 views

Authentication flaw

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

5CVSS5.4AI score0.04022EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2021/08/16 7:25 a.m.97 views

CVE-2021-35936

Apache Airflow CVE-2021-35936 affects versions older than 2.1.2. When remote logging is not used, the worker (CeleryExecutor) or the scheduler (LocalExecutor) spins up a Flask logging server that binds to 0.0.0.0 on a specific port and lacks authentication, allowing reads of DAG job log files. Th...

5.3CVSS5.7AI score0.04022EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2021/08/16 7:25 a.m.33 views

CVE-2021-35936 No Authentication on Logging Server

If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...

5.7AI score0.04022EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2021/08/16 12:00 a.m.9 views

PT-2021-21067 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.1.2 Description: The issue affects the logging server in Apache Airflow, which has no authentication and allows reading log files of DAG jobs when remote logging is not used. This could potentially expose...

5.3CVSS5.6AI score0.04022EPSS
SaveExploits0References13
CNNVD
CNNVD
added 2021/08/16 12:00 a.m.8 views

Apache Airflow 访问控制错误漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow versions prior to 2.1.2, which stems fr...

5.3CVSS6.4AI score0.04022EPSS
SaveExploits0References4
CNVD
CNVD
added 2021/06/29 12:00 a.m.32 views

Apache Airflow Cross-Site Scripting Vulnerability (CNVD-2022-09242)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A cross-site scripting vulnerability exists in Apache Airflow. The vulnerability...

6.1CVSS6.1AI score0.14389EPSS
SaveExploits0References1
Github Security Blog
Github Security Blog
added 2021/06/18 6:43 p.m.127 views

Cross-site Scripting in Apache Airflow

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions 1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fi...

6.1CVSS6.5AI score0.14389EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2021/06/18 6:43 p.m.31 views

GHSA-3XXV-P78R-4FC6 Cross-site Scripting in Apache Airflow

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions 1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fi...

6.1CVSS6.9AI score0.14389EPSS
SaveExploits0References7
Github Security Blog
Github Security Blog
added 2021/06/18 6:30 p.m.92 views

Improper Authentication in Apache Airflow

The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can jus...

5.3CVSS4.1AI score0.04555EPSS
SaveExploits0References11Affected Software1
OSV
OSV
added 2021/06/18 6:30 p.m.29 views

GHSA-FH37-CX83-Q542 Improper Authentication in Apache Airflow

The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can jus...

6.9CVSS5.2AI score0.04555EPSS
SaveExploits0References12
OSV
OSV
added 2021/06/18 6:29 p.m.56 views

GHSA-4PWQ-FJ89-6RJC Apache Airflow Cross-site Scripting

In Apache Airflow 1.10.12, the origin parameter passed to some of the endpoints like /trigger and was vulnerable to a XSS exploit...

6.1CVSS5.9AI score0.25076EPSS
SaveExploits0References14
Github Security Blog
Github Security Blog
added 2021/06/18 6:29 p.m.90 views

Apache Airflow Cross-site Scripting

In Apache Airflow 1.10.12, the origin parameter passed to some of the endpoints like /trigger and was vulnerable to a XSS exploit...

6.1CVSS2.5AI score0.25076EPSS
SaveExploits0References13Affected Software1
Rows per page
Query Builder