3414 matches found
Apache Airflow Licensing Issue Vulnerability (CNVD-2022-62076)
Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform is scalable and dynamically monitored. Apache Airflow is vulnerable to an authorization issue that stems from a lack of authorization protection on the product's...
Denial Of Service (DoS)
apacheairflow is vulnerable to denial of service. The vulnerability exists due to a lack of check on the endpoint to add/modify Airflow variables used in DAGs, causing the system to crash, expose information or execute code/scripts...
CVE-2021-38540
The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...
CVE-2021-38540
The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...
PYSEC-2021-326
The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...
acceldata-o2a (=1.0.0), acryl-datahub-airflow-plugin (>=0.9.5.1rc1 <=1.3.1.post1) +118 more potentially affected by CVE-2021-38540 via apache-airflow (>=2.0.0 <=2.1.2)
apache-airflow PYPI version =2.0.0, =0.9.5.1rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.1.0rc3, =0.1.0, =0.4.0, =0.1.0a1, =0.6.0, =0.1.1, =0.1.1, =0.10.2, =0.11.0 - airflow-ditto =0.0.1.2 and more Source cves: CVE-2021-38540 Source advisory: OSV:PYSEC-2021-326...
CVE-2021-38540
The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...
PYSEC-2021-326
The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...
Information disclosure
The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...
CVE-2021-38540
Affected software: Apache Airflow 2.x, specifically >=2.0.0 and
CVE-2021-38540 Apache Airflow: Variable Import endpoint missed authentication check
The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...
Apache Airflow 访问控制错误漏洞
Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform is scalable and dynamically monitored. Apache Airflow is vulnerable to an authorization issue that stems from a lack of authorization protection on the product's...
acceldata-o2a (=1.0.0), acryl-datahub-airflow-plugin (>=0.9.5.1rc1 <=1.3.1.post1) +119 more potentially affected by CVE-2021-35936 via apache-airflow (>=1.8.2 <=2.1.1)
apache-airflow PYPI version =1.8.2, =0.9.5.1rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.1.0rc3, =0.1.0, =0.4.0, =0.1.0a1, =0.6.0, =0.1.1, =0.1.1, =0.10.2, =0.11.0 - airflow-ditto =0.0.1.2 and more Source cves: CVE-2021-35936 Source advisory: OSV:GHSA-M6H2-JX9V-58W6...
GHSA-M6H2-JX9V-58W6 Missing Authorization in Apache Airflow
If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...
Missing Authorization in Apache Airflow
If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...
Information Disclosure
apache-airflow is vulnerable to information disclosure. The logging server running on port 0.0.0.0 by default has no authentication and allows reading log files of DAG jobs...
CVE-2021-35936
If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...
CVE-2021-35936
If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...
PYSEC-2021-122
If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...
PYSEC-2021-122
If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...