3410 matches found
addok (>=0.1.0 <=0.5.0), aglow (>=0.1.0rc3 <=0.1.0rc4) +62 more potentially affected by CVE-2018-1000164 via gunicorn (>=0.17.2 <=19.4.5)
gunicorn PYPI version =0.17.2, =0.1.0, =0.1.0rc3, =0.1.0, =2022.9.19, =0.5.1, =1.0.0, =1.10.0, =1.10.3, =0.1.1, =2.0.0, =0.1.0, =0.1.0, =5.0.0, =6.3.0 and more Source cves: CVE-2018-1000164 Source advisory: OSV:PYSEC-2018-55...
airflow-plugins (=0.1.3), tf-run-manager (>=1.0.0 <=2.1.6) potentially affected by CVE-2018-7750 via paramiko (=2.3.1)
paramiko PYPI version =2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - airflow-plugins =0.1.3 - tf-run-manager =1.0.0, =2.1.6 Source cves: CVE-2018-7750 Source advisory: OSV:PYSEC-2018-19...
alo7-airflow (>=1.10.0 <=1.10.0.7), cateye (>=0.3.4 <=0.3.6) +1 more potentially affected by CVE-2018-7753 via bleach (>=2.1.0 <=2.1.2)
bleach PYPI version =2.1.0, =1.10.0, =0.3.4, =0.3.6 - protobuf-compiler =1.0.20 Source cves: CVE-2018-7753 Source advisory: OSV:PYSEC-2018-51...
Cross-Site Scripting (XSS)
airflow is vulnerable to cross-site scripting XSS attacks. These attacks are possible through the insecure headers endpoint, allowing the attacker to get the authproxy cookie to use for authentication to other internal services...
Cross-site Scripting (XSS)
airflow is vulnerable to cross-site scripting XSS attacks. These attacks are possible through the variable view, when the variable template doesn't exist. When this happens, the input is returned to the user without being escaped...
Remote Code Execution (RCE)
airflow is vulnerable to remote code execution RCE attacks. The attacks are possible because it does not prevent the chartdata endpoints taking arbitrary strings and executing them...
Cross-site Scripting (XSS)
airflow is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the markup before rendering, allowing a malicious user to inject and execute arbitrary javascript...
Remote Code Execution (RCE)
airflow is vulnerable to remote code execution RCE. The package uses the pickle Python module unsafely, allowing remote attackers to execute code through a serialized object...
Remote Code Execution (RCE)
airflow is vulnerable to remote code execution RCE . It can happen because it passes user-controllable data as the default parameters to the python eval function which directly executes the parameters. Therefore any users who can create or edit charts can trigger the attack in airflow server...