SUSE SLES15 Security Update : terraform-provider-helm (SUSE-SU-2023:3508-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:3508-1 advisory. - rebuild the package with the go 1.21 security release bsc1212475. Tenable has extracted the preceding description block directly from the...

SUSE-SU-2023:3508-1 Security update for terraform-provider-helm

This update of terraform-provider-helm fixes the following issues: - rebuild the package with the go 1.21 security release bsc1212475...

PT-2023-36252 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security concern addressed by rebuilding the package with the go 1.21 security release. Recommendations: At the moment, there is no information abo...

Malicious code in web3-provider-patchers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a3da847a0100e6d34ec1eaaf261644c00fcc8342f19bf86f01da33f61a7fb9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-7961 Malicious code in web3-provider-patchers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a3da847a0100e6d34ec1eaaf261644c00fcc8342f19bf86f01da33f61a7fb9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Deserialization Of Untrusted Data

Apache Airflow Spark Provider is vulnerable to deserialization of untrusted data. The vulnerability occurs when an authorized Airflow user configures Spark hooks on an Airflow node pointing it to a malicious Spark server in an Airflow deployment causing arbitrary code to be run on that Airflow...

Remote Code Execution

Apache Airflow Scoop Provider is vulnerable to Remote Code Execution RCE. The vulnerability is caused by not validating/sanitizing the connection url used to import data from RDBMS e.g MySQL or Oracle into the Hadoop Distributed File System HDFS. The attacker can execute malicious commands by...

Apache Airflow code execution vulnerability (CNVD-2023-85614)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A code execution vulnerability exists in Apache Airflow Spark Provider, which can b...

Apache Airflow Input Validation Error Vulnerability (CNVD-2023-70278)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow Sqoop Provider...

The vulnerabilities of the Airflow SMTP Provider and Airflow IMAP Provider software, which are used for creating, monitoring, and orchestrating data processing scenarios in Airflow, allow attackers to gain unauthorized access to confidential data.

The vulnerabilities of the Airflow SMTP Provider and Airflow IMAP Provider, which are software components for creating, monitoring, and orchestrating data processing scenarios, are related to errors in the certificate validation process. Exploiting these vulnerabilities can allow an attacker to...

CVE-2023-39522

goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recover...

Design/Logic Flaw

goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recover...

CVE-2023-39522

goauthentik (open‑source Identity Provider) contains a vulnerability in affected versions using a recovery flow with an identification stage that allows an attacker to determine whether a username exists, enabling username/email enumeration. The issue affects setups with the recovery flow and can...

CVE-2023-39522 Username enumeration attack in goauthentik

goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recover...

CVE-2023-39522 Username enumeration attack in goauthentik

goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recover...

PT-2023-26994

Name of the Vulnerable Software and Affected Versions goauthentik versions prior to 2023.5.6 goauthentik versions prior to 2023.6.2 Description The issue affects goauthentik, an open-source Identity Provider, where an attacker can determine if a username exists using a recovery flow with an...

GHSA-G3M9-PR5M-4CVP Airflow Sqoop Provider RCE Vulnerability

Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged...

Apache Airflow vulnerable arbitrary code execution via Spark server

Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider. When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks...

Airflow Sqoop Provider RCE Vulnerability

Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged...

CVE-2023-27604

Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged...