CVE-2018-20245

CVE-2018-20245 affects Apache Airflow versions prior to 1.10.1, where the LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) had improper exception handling that disabled server certificate checking. This misconfiguration enables potential Man‑in‑the‑Middle risks against LDAP connections...

CVE-2017-17836

In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the...

CVE-2017-15720

In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object...

CVE-2017-17835

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow...

CVE-2018-20245

The LDAP auth backend airflow.contrib.auth.backends.ldapauth prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking...

Apache Airflow Cross-Site Scripting Vulnerability

Apache Airflow is the United States Apache Apache Software Foundation's set of open source platform for creating, managing and monitoring workflow. The platform has dynamic and scalable features. A cross-site scripting vulnerability exists in the 404 page in Apache Airflow version 1.8.1. A remote...

CVE-2017-12614

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

Design/Logic Flaw

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

PYSEC-2018-45

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

PYSEC-2018-45

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

CVE-2017-12614

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

CVE-2017-12614

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

CVE-2017-12614

CVE-2017-12614 describes a reflected cross-site scripting vulnerability on Apache Airflow 404 pages. The root cause is an XSS in certain 404 endpoints, with Chrome detecting it as reflected but other browsers remaining vulnerable. Affected product: Apache Airflow (version unspecified in the initi...

Insecure Defaults

apache-airflow is vulnerable to insecure defaults. The library uses a default SECRETKEY parameter that is the same for all installations, allowing a malicious user to create an authentic session to the application if the SECRETKEY wasn't changed...

Honda, Universal Music Group Expose Sensitive Data in Misconfig Blunders

Server and cloud misconfigs continue to plague companies and their customers: This week it came to light that a Universal Music Group contractor neglected to protect an Apache Airflow server, leaving data exposed; while a Honda affiliate in India left two Amazon S3 buckets misconfigured for more...

Cross-Site Scripting (XSS)

airflow is vulnerable to cross-site scripting XSS attacks. These attacks are possible through the insecure headers endpoint, allowing the attacker to get the authproxy cookie to use for authentication to other internal services...

Cross-site Scripting (XSS)

airflow is vulnerable to cross-site scripting XSS attacks. These attacks are possible through the variable view, when the variable template doesn't exist. When this happens, the input is returned to the user without being escaped...

Remote Code Execution (RCE)

airflow is vulnerable to remote code execution RCE attacks. The attacks are possible because it does not prevent the chartdata endpoints taking arbitrary strings and executing them...

Cross-site Scripting (XSS)

airflow is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the markup before rendering, allowing a malicious user to inject and execute arbitrary javascript...

Remote Code Execution (RCE)

airflow is vulnerable to remote code execution RCE. The package uses the pickle Python module unsafely, allowing remote attackers to execute code through a serialized object...