CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27349 – Apache HugeGraph-Server: Bypass whitelist in Auth mode
https://notcve.org/view.php?id=CVE-2024-27349
Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue. Vulnerabilidad de omisión de autenticación mediante suplantación de identidad en Apache HugeGraph-Server. Este problema afecta a Apache HugeGraph-Server: desde 1.0.0 antes de 1.3.0. Se recomienda a los usuarios actualizar a la versión 1.3.0, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/04/22/4 https://lists.apache.org/thread/dz9n9lndqfsf64t72o73r7sttrc6ocsd • CWE-290: Authentication Bypass by Spoofing •
CVSS: 9.8EPSS: 96%CPEs: 1EXPL: 3CVE-2024-27348 – Apache HugeGraph-Server Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2024-27348
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue. Vulnerabilidad de ejecución remota de comandos RCE en Apache HugeGraph-Server. Este problema afecta a Apache HugeGraph-Server: desde 1.0.0 antes de 1.3.0 en Java8 y Java11. Se recomienda a los usuarios actualizar a la versión 1.3.0 con Java11 y habilitar el sistema de autenticación lo que soluciona el problema. Apache HugeGraph versions 1.0.0 and up to 1.3.0 suffer from a remote command execution vulnerability. • https://github.com/Zeyad-Azima/CVE-2024-27348 https://github.com/kljunowsky/CVE-2024-27348 https://github.com/jakabakos/CVE-2024-27348-Apache-HugeGraph-RCE http://www.openwall.com/lists/oss-security/2024/04/22/3 https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9 • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27347 – Apache HugeGraph-Hubble: SSRF in Hubble connection page
https://notcve.org/view.php?id=CVE-2024-27347
Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue. Vulnerabilidad de Server-Side Request Forgery (SSRF) en Apache HugeGraph-Hubble. Este problema afecta a Apache HugeGraph-Hubble: desde 1.0.0 antes de 1.3.0. Se recomienda a los usuarios actualizar a la versión 1.3.0, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/04/22/2 https://lists.apache.org/thread/z0v71148slfkw60hsp35pl7ddjyvg01l • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 2.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29733 – Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context
https://notcve.org/view.php?id=CVE-2024-29733
Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly. This issue affects Apache Airflow FTP Provider: before 3.7.0. Users are recommended to upgrade to version 3.7.0, which fixes the issue. Vulnerabilidad de validación de certificado incorrecta en el proveedor FTP Apache Airflow. El enlace FTP carece de una validación completa del certificado en las conexiones FTP_TLS, lo que potencialmente puede aprovecharse. La implementación de una validación de certificados adecuada pasando context=ssl.create_default_context() durante la creación de instancias de FTP_TLS se utiliza como mitigación para validar los certificados correctamente. • http://www.openwall.com/lists/oss-security/2024/04/19/3 https://docs.python.org/3/library/ssl.html#best-defaults https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280 https://github.com/apache/airflow/pull/38266 https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2 • CWE-295: Improper Certificate Validation •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29217 – Apache Answer: XSS vulnerability when changing personal website
https://notcve.org/view.php?id=CVE-2024-29217
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue. Neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web ('cross-site Scripting') en Apache Answer. Este problema afecta a Apache Answer: versiones anteriores a 1.3.0. Ataque XSS cuando el usuario cambia de sitio web personal. • http://www.openwall.com/lists/oss-security/2024/04/19/1 https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •