2109 matches found
CVE-2020-17513
Apache Airflow versions prior to 1.10.13 expose a Server-Side Request Forgery (SSRF) vulnerability in the old Flask-admin UI, specifically the Charts and Query View. The issue is described as SSRF in the Chart/Query View of the legacy UI, without details on exploit vectors, affected subcomponents...
CVE-2020-17513
In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old Flask-admin based UI were vulnerable for SSRF attack...
Cross-Site Scripting (XSS)
apacheairflow is vulnerable to cross-site scripting XSS. The vulnerability exists due to an incomplete fix of CVE-2020-13944, where the origin parameter passed to some endpoints were not sanitized...
CVE-2020-17515
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely...
CVE-2020-17515
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely...
Design/Logic Flaw
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely...
PYSEC-2020-21
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely...
CVE-2020-17515
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely...
CVE-2020-17515
The CVE-2020-17515 issue is an XSS vulnerability in the Apache Airflow “origin” parameter (e.g., in /trigger). The root cause is an unpatched origin parameter allowing reflected/scriptable input. Public details indicate affected versions include Airflow releases prior to the patched point (initia...
PT-2020-6602 · Apache · Apache Airflow
Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 1.10.11 Description: The issue is related to the Experimental API in Apache Airflow, which previously allowed all API requests without authentication by default. This poses security risks to users who are not...
Apache Airflow Cross-Site Scripting Vulnerability (CNVD-2020-52628)
Apache Airflow is an open source tool for orchestrating complex computational workflows and data processing pipelines. A cross-site scripting vulnerability exists in the 'origin' parameter passed to certain endpoints in Apache Airflow versions prior to 1.10.12. No detailed vulnerability details a...
CVE-2020-13944
In Apache Airflow 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit...
CVE-2020-13944
In Apache Airflow 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit...
Design/Logic Flaw
In Apache Airflow 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit...
PYSEC-2020-19
In Apache Airflow 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit...
PYSEC-2020-19
In Apache Airflow 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit...
CVE-2020-13944
In Apache Airflow 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit...
PT-2020-13795 · Apache · Apache Airflow
Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 1.10.12 Description: The issue concerns a XSS exploit in Apache Airflow. The origin parameter passed to certain endpoints, such as /trigger, is vulnerable to this exploit. Recommendations: For versions prior t...
Stored XSS in Apache Airflow
An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI...