CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31979 – Apache StreamPipes: Possibility of SSRF in pipeline element installation process
https://notcve.org/view.php?id=CVE-2024-31979
17 Jul 2024 — Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue. Ser... • https://lists.apache.org/thread/8lryp3bxnby9kmk13odkz2jbfdjfvf0y • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-30471 – Apache StreamPipes: Potential creation of multiple identical accounts
https://notcve.org/view.php?id=CVE-2024-30471
17 Jul 2024 — Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request the creation of multiple accounts with the same email address until the email address is registered, creating many identical users and corrupting StreamPipe's user management. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue. Time-of-check Time-of-use (TOCTOU) Race Condit... • https://lists.apache.org/thread/8yodrmohgcybq900or3d4hc1msl230fr • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29737 – Apache StreamPark (incubating): maven build params could trigger remote command execution
https://notcve.org/view.php?id=CVE-2024-29737
17 Jul 2024 — In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability ... • http://www.openwall.com/lists/oss-security/2024/07/17/2 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-52291 – Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution
https://notcve.org/view.php?id=CVE-2023-52291
17 Jul 2024 — In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability ... • http://www.openwall.com/lists/oss-security/2024/07/17/1 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39877 – Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler
https://notcve.org/view.php?id=CVE-2024-39877
17 Jul 2024 — Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability. Apache Airflow 2.4.0 y versiones anteriores a 2.9.3 tienen una vulnerabilidad que permite a los autores de DAG autenticados crear un parámetro doc_md de mane... • https://github.com/apache/airflow/pull/40522 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-277: Insecure Inherited Permissions •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39863 – Apache Airflow: Potential XSS Vulnerability
https://notcve.org/view.php?id=CVE-2024-39863
17 Jul 2024 — Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue. Las versiones de Apache Airflow anteriores a la 2.9.3 tienen una vulnerabilidad que permite a un atacante autenticado inyectar un enlace malicioso al instalar un proveedor. Se recomienda a los usuarios actualizar a la versión 2.9.3, que soluciona este problema. • https://github.com/apache/airflow/pull/40475 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 53%CPEs: 1EXPL: 0CVE-2024-39887 – Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions
https://notcve.org/view.php?id=CVE-2024-39887
16 Jul 2024 — An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can... • https://lists.apache.org/thread/j55vm41jg3l0x6w49zrmvbf3k0ts5fqz • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-52290 – Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability
https://notcve.org/view.php?id=CVE-2023-52290
16 Jul 2024 — In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection vulnerability. The attacker must successfully log into the system to launch an attack, which may cause data leakage. Since no data will be written, so this is a low-impact vulnerability. • https://lists.apache.org/thread/t3mcm8pb65d9gj3wrgtj9sx9s2pfvvl3 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49566 – Apache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerability
https://notcve.org/view.php?id=CVE-2023-49566
15 Jul 2024 — In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0. En Apache Linkis <= 1.5.0... • https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.0EPSS: 2%CPEs: 1EXPL: 0CVE-2023-46801 – Apache Linkis DataSource: DataSource Remote code execution vulnerability
https://notcve.org/view.php?id=CVE-2023-46801
15 Jul 2024 — In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject malicious files into the server and execute them. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. We recommend that users upgrade the java version to >= 1.8.0_241. Or users upgrade Linkis to version 1.6.0. • https://lists.apache.org/thread/0dnzh64xy1n7qo3rgo2loz9zn7m9xgdx • CWE-502: Deserialization of Untrusted Data •