CVE-2024-26280

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by...

PYSEC-2024-42

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view.With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by defaul...

Design/Logic Flaw

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by...

PYSEC-2024-42

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by...

Improper Access Control

github.com/mattermost/mattermost/ is vulnerable to Improper Access Control. The vulnerability is due to a failure to check compliance export settings, allowing non-members to fetch posts without being audited. Attackers can exploit this to access sensitive information without detection...

CVE-2024-26280

Apache Airflow prior to 2.8.2 has an information-disclosure issue where authenticated Ops and Viewers can see audit-log contents (e.g., dag names, usernames not visible to them). Version 2.8.2+ fixes default audit-log permissions (Ops/Viewers no longer have access by default; admins retain access...

CVE-2024-26280 Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by...

CVE-2024-26280 Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by...

CVE-2024-26280 Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by...

PT-2024-2130 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.8.2 Description: The issue is related to incorrect default permissions in Apache Airflow, allowing authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames...

Apache Airflow 安全漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions prior to...

CVE-2024-1887

Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export...

CVE-2021-46971

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix unconditional securitylockeddown call Currently, the lockdown state is queried unconditionally, even though its result is used only if the PERFSAMPLEREGSINTR bit is set in attr.sampletype. While that doesn't matter...

CentOS 9 : libldb-2.5.2-1.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libldb-2.5.2-1.el9 build changelog. - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database...

CVE-2024-0831

A sensitive information disclosure vulnerability was found in Hashicorp Vault. Enabling an audit device that specifies the lograw option may log sensitive information to oth...

CVE-2021-46971

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix unconditional securitylockeddown call Currently, the lockdown state is queried unconditionally, even though its result is used only if the PERFSAMPLEREGSINTR bit is set in attr.sampletype. While that doesn't matter...

CVE-2021-46971

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix unconditional securitylockeddown call Currently, the lockdown state is queried unconditionally, even though its result is used only if the PERFSAMPLEREGSINTR bit is set in attr.sampletype. While that doesn't matter...

CVE-2021-46971 perf/core: Fix unconditional security_locked_down() call

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix unconditional securitylockeddown call Currently, the lockdown state is queried unconditionally, even though its result is used only if the PERFSAMPLEREGSINTR bit is set in attr.sampletype. While that doesn't matter...

CVE-2021-46971 perf/core: Fix unconditional security_locked_down() call

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix unconditional securitylockeddown call Currently, the lockdown state is queried unconditionally, even though its result is used only if the PERFSAMPLEREGSINTR bit is set in attr.sampletype. While that doesn't matter...

Microsoft Expands Free Logging Capabilities for all U.S. Federal Agencies

Microsoft has expanded free logging capabilities to all U.S. federal agencies using Microsoft Purview Audit irrespective of the license tier, more than six months after a China-linked cyber espionage campaign targeting two dozen organizations came to light. "Microsoft will automatically enable th...