CVE-2023-36456 Authentik lacks Proxy IP headers validation

authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without a reverse proxy a...

PT-2023-25576

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2023.4.3 and 2023.5.5 Description The issue concerns the lack of verification of the source of the X-Forwarded-For and X-Real-IP headers in authentik, an open-source Identity Provider. This poses a security risk whe...

Apache Hive Provider Code Execution Vulnerability

Apache Airflow is a suite of open source platforms for creating, managing, and monitoring workflows from the Apache Foundation.The Apache Airflow Hive Provider is a toolkit for reading, writing, and managing large datasets in distributed storage using SQL. A code execution vulnerability exists in...

Apache Airflow Hive Provider Beeline remote code execution with Principal

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it...

Input validation

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it...

CVE-2023-35797 Apache Airflow Hive Provider Beeline RCE with Principal

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it...

CVE-2023-35797 Apache Airflow Hive Provider Beeline RCE with Principal

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it...

CVE-2023-35797 Apache Airflow Hive Provider Beeline RCE with Principal

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it...

CVE-2023-35797

CVE-2023-35797 affects Apache Airflow Hive Provider prior to 6.1.1 and is an Improper Input Validation vulnerability that can enable remote code execution via the principal parameter when connection details are modifiable. The issue is mitigated by upgrading the provider to version 6.1.1 or later...

Apache Airflow 输入验证错误漏洞

Apache Airflow is a suite of open source platforms for creating, managing, and monitoring workflows from the Apache Foundation.The Apache Airflow Hive Provider is a toolkit for reading, writing, and managing large datasets in distributed storage using SQL. A code execution vulnerability exists in...

Apache Airflow JDBC Provider Code Execution Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. A code execution vulnerability exists in Apache Airflow JDBC Provider, which can be exploited by an attacker to execute arbitrary code on a system...

openSUSE 15 Security Update : terraform-provider-helm (SUSE-SU-2023:2752-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:2752-1 advisory. - rebuild the package with the go 1.20 security release bsc1206346. Tenable has extracted the preceding description block directly from the SUSE security...

openSUSE 15 Security Update : terraform-provider-null (SUSE-SU-2023:2753-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:2753-1 advisory. - rebuild the package with the go 1.20 security release bsc1206346. Tenable has extracted the preceding description block directly from the SUSE security...

openSUSE 15 Security Update : terraform-provider-aws (SUSE-SU-2023:2751-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:2751-1 advisory. - rebuild the package with the go 1.20 security release bsc1206346. Tenable has extracted the preceding description block directly from the SUSE security...

SUSE SLES15 Security Update : terraform-provider-helm (SUSE-SU-2023:2750-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2750-1 advisory. - rebuild the package with the go 1.20 security release bsc1206346. Tenable has extracted the preceding description block directly from the...

SUSE-SU-2023:2753-1 Security update for terraform-provider-null

This update of terraform-provider-null fixes the following issues: - rebuild the package with the go 1.20 security release bsc1206346...

SUSE-SU-2023:2752-1 Security update for terraform-provider-helm

This update of terraform-provider-helm fixes the following issues: - rebuild the package with the go 1.20 security release bsc1206346...

SUSE-SU-2023:2751-1 Security update for terraform-provider-aws

This update of terraform-provider-aws fixes the following issues: - rebuild the package with the go 1.20 security release bsc1206346...

SUSE-SU-2023:2750-1 Security update for terraform-provider-helm

This update of terraform-provider-helm fixes the following issues: - rebuild the package with the go 1.20 security release bsc1206346...

DoS and DDoS Attacks against Multiple Sectors

CISA is aware of open-source reporting of targeted denial-of-service DoS and distributed denial-of-service DDoS attacks against multiple organizations in multiple sectors. These attacks can cost an organization time and money and may impose reputational costs while resources and services are...