Apache DolphinScheduler 输入验证错误漏洞

Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache Apache Foundation in the United States. An input validation error vulnerability exists in Apache DolphinScheduler versions prior to 3.2.1, which stems from the presence of incorrect...

Apache DolphinScheduler 输入验证错误漏洞

Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache Apache Foundation in the United States. A security vulnerability exists in Apache DolphinScheduler 3.1.9 and earlier versions, which can be exploited by an unauthenticated attacker to...

PT-2023-30962

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions 3.0.0 through 3.0.1 Description The issue concerns the exposure of sensitive information to unauthorized actors, potentially including database credentials. This exposure can occur in Apache DolphinScheduler,...

dolphin-aid.eu Cross Site Scripting vulnerability OBB-3577748

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

dolphin-aid.eu Cross Site Scripting vulnerability OBB-3518389

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

dolphin-gt.co.jp Cross Site Scripting vulnerability OBB-3491880

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

dolphin-academy.com Cross Site Scripting vulnerability OBB-3314259

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Apache DolphinScheduler 授权问题漏洞

Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache Apache Foundation in the United States. Apache DolphinScheduler suffers from an authorization problem vulnerability that stems from the presence of incorrect authentication, which can ...

PT-2023-20191 · Apache · Apache Dolphinscheduler

Name of the Vulnerable Software and Affected Versions: Apache DolphinScheduler versions 3.0.0 through 3.1.1 Description: The issue concerns improper authentication in Apache DolphinScheduler's python gateway, allowing an attacker to use a socket bytes attack without authentication. This has been...

Google Warns of Internet Explorer Zero-Day Vulnerability Exploited by ScarCruft Hackers

An Internet Explorer zero-day vulnerability was actively exploited by a North Korean threat actor to target South Korean users by capitalizing on the recent Itaewon Halloween crowd crush to trick users into downloading malware. The discovery, reported by Google Threat Analysis Group researchers...

North Korean APT37 Unleashes Dolphin Backdoor on South Korea

By Habiba Rashid The backdoor is equipped with a wide range of spying capabilities, including exfiltrating files, keylogging, and stealing browser data, etc. This is a post from HackRead.com Read the original post: North Korean APT37 Unleashes Dolphin Backdoor on South Korea...

How ScarCruft APT group enhances its toolkit with a powerful Dolphin backdoor

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ScarCurft aka Reaper, APT 37, Ricochet Chollima is North Korean espionage group, active since 2012. ScarCruft has targeted South Korea Newspaper with a watering hole attack in the last year. In this...

North Korea Hackers Using New "Dolphin" Backdoor to Spy on South Korean Targets

The North Korea-linked ScarCruft group has been attributed to a previously undocumented backdoor called Dolphin that the threat actor has used against targets located in its southern counterpart. "The backdoor ... has a wide range of spying capabilities, including monitoring drives and portable...

Apache Dolphin Scheduler has insufficiently protected credentials

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher...

GHSA-JVC3-WJF6-7C6C Apache Dolphin Scheduler has insufficiently protected credentials

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher...

PT-2022-18121 · Apache · Apache Dolphinscheduler

Name of the Vulnerable Software and Affected Versions: Apache DolphinScheduler versions prior to 2.0.6 Description: The issue allows users to read any files by logging into the server. Apache DolphinScheduler users are advised to take action to protect themselves. Recommendations: For versions...

Malicious code in dolphin-database (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d93e1e2aae05851554793d8482112dfc1c9485368c8e532351decdfea864f7db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dolphin-dbase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cd9702f3fa3f82c265a1cb8d73de3f9f7446372aac73b4ce46efeaa5802cd1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in db-dolphin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f31c91df2858e430559be9af39930325d40063e82634ee7dff673a2d7fab5cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in database-dolphin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79b2e30186b844000b934aea745f8c00cd4735e5a791a36e4cb86eae6406a298 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...