3313 matches found
CVE-2022-43982 Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL
In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...
Apache Airflow Command Injection (CVE-2022-24288)
A command injection vulnerability exists in Apache Airflow. This vulnerability is due to improper input validation for parameters for directed acyclic graphs DAGs...
Apache Airflow code issue vulnerability
Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. Apache Airflow 2.4.1 and earlier versions have a code issue vulnerability that stems from the failure of deactivated users to prevent authenticated users from continuing to use t...
Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...
GHSA-3Q8R-F3PJ-3GC4 Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...
CVE-2022-41672
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...
CVE-2022-41672
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...
PYSEC-2022-42983
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...
Code injection
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...
PYSEC-2022-42983
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...
CVE-2022-41672 Session still functional after user is deactivated
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...
CVE-2022-41672
In Apache Airflow, CVE-2022-41672 affects versions prior to 2.4.1, where deactivating a user does not prevent an already authenticated user from continuing to use the UI or API. The NVD entry lists a high impact (CVSS v3.1 base score 8.1) with privileges required: low and no user interaction, ind...
Apache Airflow 代码问题漏洞
Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. Apache Airflow 2.4.1 and earlier versions have a code issue vulnerability that stems from the failure of deactivated users to prevent authenticated users from continuing to use t...
CVE-2022-41672 Session still functional after user is deactivated
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...
Apache Airflow Open Redirect Vulnerability
Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache Foundation. Apache Airflow versions 2.3.0 to 2.3.4 have an open redirection vulnerability, which originates from the /confirm port of the web server does not do a reasonable job on the target...
Apache Airflow Information Disclosure Vulnerability (CNVD-2022-73695)
Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache Foundation. The platform features scalable and dynamic monitoring. Apache Airflow versions 2.3.0 to 2.3.4 contain an information disclosure vulnerability that could be exploited by attackers ...
Apache Airflow vulnerable to Use of Externally-Controlled Format String
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...
GHSA-5RP4-749P-VX26 Apache Airflow vulnerable to Use of Externally-Controlled Format String
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...