2035 matches found
CVE-2022-43982
In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...
Open redirect
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's /confirm endpoint...
PYSEC-2022-42971
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's /confirm endpoint...
Design/Logic Flaw
In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...
PYSEC-2022-42971
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's /confirm endpoint...
PYSEC-2022-42970
In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...
CVE-2022-43982 Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL
In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...
CVE-2022-43985
In Apache Airflow, versions prior to 2.4.2 contain an open redirect in the webserver’s /confirm endpoint. Affected component is the Airflow webserver; root cause is an open redirect path in /confirm. The practical impact is an open redirect vulnerability (no exploitation details provided in the s...
CVE-2022-43985 Apache Airflow prior to 2.4.2 has an open redirect
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's /confirm endpoint...
CVE-2022-43985 Apache Airflow prior to 2.4.2 has an open redirect
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's /confirm endpoint...
CVE-2022-43982
CVE-2022-43982 (Apache Airflow) refers to a cross-site scripting vulnerability in versions prior to 2.4.2, where the Trigger DAG with config screen is vulnerable to XSS via the origin query parameter. The issue arises in the web UI when user-supplied data in origin is reflected back, potentially ...
CVE-2022-43985 Apache Airflow prior to 2.4.2 has an open redirect
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's /confirm endpoint...
CVE-2022-43982 Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL
In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...
Apache Airflow 跨站脚本漏洞
Apache Airflow is a community-created platform for programmatically authoring, scheduling, and monitoring workflows. a cross-site scripting vulnerability exists in versions of Apache Airflow prior to 2.4.2. The vulnerability is related to the affected version not properly filtering user input. Th...
CVE-2022-43982 Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL
In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...
Apache Airflow Command Injection (CVE-2022-24288)
A command injection vulnerability exists in Apache Airflow. This vulnerability is due to improper input validation for parameters for directed acyclic graphs DAGs...
Apache Airflow code issue vulnerability
Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. Apache Airflow 2.4.1 and earlier versions have a code issue vulnerability that stems from the failure of deactivated users to prevent authenticated users from continuing to use t...
Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...
GHSA-3Q8R-F3PJ-3GC4 Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...