EUVD-2024-0480

Malicious code in bioql PyPI...

Improper Certificate Validation

org.apache.dolphinscheduler: dolphinscheduler-common is vulnerable to Improper Certificate Validation. The vulnerability is due to a lack of certificate verification in the HttpUtils class. This allows an attacker to perform a Man-in-the-Middle MITM attack by impersonating the server...

Improper Certificate Validation in Apache DolphinScheduler

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which...

CVE-2023-49250

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

Hardcoded credentials

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

CVE-2023-49250 Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

CVE-2023-49250

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

CVE-2023-49250: Improper Certificate Validation

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

PT-2024-13709

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.2.0 Description The issue arises because the HttpUtils class did not verify certificates, allowing an attacker to perform a Man-in-the-Middle MITM attack on outgoing https connections and impersonate...

Missing Authentication for Critical Function in Apache Calcite

"HttpUtilsgetURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses this method internally to connect with Druid and Splunk so information leakage may happen when using the respective Calcite...

Apache Calcite Dynamic Data Management Framework Man-in-the-Middle

The vulnerability of the HttpUtilsgetURLConnection method in the Apache Calcite dynamic data management framework is related to the absence of authentication procedures. Exploiting this vulnerability could allow an attacker to execute a “man-in-the-middle” attack or gain unauthorized access to...

CVE-2020-13955

HttpUtilsgetURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapter...

CVE-2020-13955

HttpUtilsgetURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapter...

CVE-2020-13955

CVE-2020-13955 affects Apache Calcite: HttpUtils#getURLConnection disables hostname verification for HTTPS, enabling potential MITM attacks and information leakage when Calcite adapters connect to Druid or Splunk. The issue originates from a utility method that can be used to create vulnerable HT...

CVE-2020-13955

HttpUtilsgetURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapter...

CVE-2020-13955: Improper Certificate Validation

HttpUtilsgetURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapter...

PT-2020-5838

Name of the Vulnerable Software and Affected Versions: Apache Calcite versions prior to 1.26 Description: The issue is related to the HttpUtilsgetURLConnection method, which disables hostname verification for HTTPS connections, making clients vulnerable to man-in-the-middle attacks. This method i...

Design/Logic Flaw

Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.splitheadervalue function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of...

CVE-2008-3656

Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.splitheadervalue function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of...

CVE-2008-3656

The CVE-2008-3656 issue is a denial-of-service in WEBrick’s HTTP header handling: WEBrick::HTTPUtils.split_header_value in WEBrick::DefaultFileHandler backed by a backtracking regex causes CPU exhaustion when processing crafted HTTP requests. Affected Ruby versions include 1.8.5 and earlier, 1.8....