CVE-2019-0229

A number of HTTP endpoints in the Airflow webserver both RBAC and classic did not have adequate protection and were vulnerable to cross-site request forgery attacks...

CVE-2019-0229

The CVE-2019-0229 entry concerns cross-site request forgery (CSRF) in the Airflow webserver. The affected surface is multiple HTTP endpoints in both the RBAC and classic Airflow webservers, where protections against CSRF are insufficient. Root cause cited across connected sources is lack of adequ...

CVE-2019-0229

A number of HTTP endpoints in the Airflow webserver both RBAC and classic did not have adequate protection and were vulnerable to cross-site request forgery attacks...

CVE-2019-0229: Cross-Site Request Forgery (CSRF)

A number of HTTP endpoints in the Airflow webserver both RBAC and classic did not have adequate protection and were vulnerable to cross-site request forgery attacks...

CVE-2019-0216: Improper Neutralization of Input During Web Page Generation

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

PT-2019-11201

Name of the Vulnerable Software and Affected Versions: Apache Airflow affected versions not specified Description: The issue concerns a lack of adequate protection in several HTTP endpoints within the Airflow webserver, making them susceptible to cross-site request forgery attacks. This affects...

Apache Airflow vulnerable to Stored XSS

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

GHSA-99CV-8CVV-666C Apache Airflow vulnerable to Stored XSS

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

Cross-Site Scripting (XSS)

apache-airflow is vulnerable to cross-site scripting XSS. An admin user is able to inject arbitrary Javascript into a victim's browser through the modification of state of objects in the metadata database, which would execute on certain page views...

CVE-2018-20244

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

PYSEC-2019-142

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

Code injection

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

CVE-2018-20244

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

PYSEC-2019-142

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

CVE-2018-20244

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

CVE-2018-20244

CVE-2018-20244 affects Apache Airflow before 1.10.2. A malicious admin can edit the state of objects in the Airflow metadata database to inject arbitrary JavaScript on certain page views, causing a Stored XSS vulnerability. The impact is that a victim’s browser could execute injected scripts when...

CVE-2018-20244

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

CVE-2018-20244: Improper Neutralization of Input During Web Page Generation

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

PT-2019-10036

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 1.10.2 Description: A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. Recommendations: For versions prior to 1.10.2,...

GHSA-77RC-X84Q-PV4F Improper Certificate Validation in Apache Airflow

The LDAP auth backend airflow.contrib.auth.backends.ldapauth prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking...