CVE-2022-38649 Apache Airflow Pinot provider allowed Command Injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airfl...

Apache Airflow 操作系统命令注入漏洞

Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform features scalable and dynamic monitoring. Apache Airflow is vulnerable to an operating system command injection vulnerability, which stems from an improper...

CVE-2022-41131: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider...

CVE-2022-41131 Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider...

CVE-2022-41131 Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider...

CVE-2022-41131 Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider...

XXL-JOB code issue vulnerability

XXL-JOB is a distributed task scheduling platform based on the java language from the Xu Xueli XXL-JOB community.A security vulnerability exists in versions prior to XXL-JOB v2.3.1, which stems from a vulnerability found via the component /admin/controller/JobLogController.java containing...

org.jenkins-ci.plugins.workflow:workflow-basic-steps (>=1017.vb_45b_302f0cea, <=1058.vcb_fc1e3a_21a_9), org.jenkins-ci.plugins.workflow:workflow-durable-task-step (>=1246.v5524618ea_097, <=1247.v7f9dfea_b_4fd0) potentially affected by CVE-2022-45379 via org.jenkins-ci.plugins:script-security (1189.vb_a_b_7c8fd5fde)

org.jenkins-ci.plugins:script-security MAVEN version 1189.vbab7c8fd5fde is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-basic-steps...

kernel: sched/fair: Fix fault in reweight_entity

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix fault in reweightentity Syzbot found a GPF in reweightentity. This has been bisected to commit 4ef0c5c6b5ba "kernel/sched: Fix schedfork access an invalid schedtaskgroup" There is a race between schedpostfork and...

GSD-2022-1006797 io_uring/rw: defer fsnotify calls to task context

iouring/rw: defer fsnotify calls to task context This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit...

PT-2022-35052 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the io uring/rw component, where fsnotify calls are not properly deferred to the task context. This could potentially lead to security vulnerabilities, although the...

PT-2022-35055 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: A use-after-free bug was found in the smp execute task sg function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v2.6.19 and fixed ...

PT-2022-35515 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: A use-after-free bug was found in the smp execute task sg function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

PT-2022-35314 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: A use-after-free bug was found in the smp execute task sg function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v2.6.19 and fixe...

PT-2022-35658 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.220 Description: A use-after-free bug was found in the smp execute task sg function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

PT-2022-36767 · Git +1 · Fluent-Bit

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free READ 8 crash type. The crash state involves functions such as output thread, step callback, and flb task...

CVE-2022-3940

A vulnerability, which was classified as problematic, was found in lanyulei ferry. This affects an unknown part of the file apis/process/task.go. The manipulation of the argument filename leads to path traversal. The associated identifier of this vulnerability is VDB-213447...

ferry 路径遍历漏洞

ferry is lanyulei personal developer based on Gin + Vue + Element UI front-end and back-end separation of the work order system. There is a path traversal vulnerability in ferry, which originates from some unknown functionality in the apis/process/task.go file and can be exploited by an attacker ...

PT-2022-24958 · Unknown · Lanyulei Ferry

Name of the Vulnerable Software and Affected Versions: lanyulei ferry affected versions not specified Description: A problematic issue was found in lanyulei ferry, affecting an unknown part of the file apis/process/task.go. The manipulation of the file name argument leads to path traversal...

CVE-2022-39398: Improper Neutralization of Input During Web Page Generation

tasklists is a tasklists plugin for GLPI Kanban. Versions prior to 2.0.3 are vulnerable to Cross-site Scripting. Cross-site Scripting XSS - Create XSS in task content when add it. This issue is patched in version 2.0.3. There are no known workarounds...