CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26578 – Apache Answer: Repeated submission at registration created duplicate users with the same name
https://notcve.org/view.php?id=CVE-2024-26578
22 Feb 2024 — Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Repeated submission during registration resulted in the registration of the same user. When users register, if they rapidly submit multiple registrations using scripts, it can result in the creation of multiple user accounts simultaneously with the same name. Users are recommended to upgrade to version [1.2.5], which fixes the issue. Ejec... • http://www.openwall.com/lists/oss-security/2024/02/22/3 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25141 – Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo
https://notcve.org/view.php?id=CVE-2024-25141
20 Feb 2024 — When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue. Cuando se habilitó SSL para Mongo Hook, la configuración predeterminada incluía "allow_insecure", lo que provocaba que los certificados no se validaran. Esto fue inesperado e indocumentado. Se recomienda a los usuarios actualizar a la versión 4.0.0, que soluciona este... • http://www.openwall.com/lists/oss-security/2024/02/20/5 • CWE-295: Improper Certificate Validation •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-23114 – Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository
https://notcve.org/view.php?id=CVE-2024-23114
20 Feb 2024 — Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions it is possible to deserialize malicious payload.This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to... • https://camel.apache.org/security/CVE-2024-23114.html • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 3%CPEs: 4EXPL: 1CVE-2024-22369 – Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository
https://notcve.org/view.php?id=CVE-2024-22369
20 Feb 2024 — Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1 Vulnerabilidad de deserialización de datos no confiables en el co... • https://github.com/oscerd/CVE-2024-22369 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51770 – Apache DolphinScheduler: Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2023-51770
20 Feb 2024 — Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue. Vulnerabilidad de lectura de archivos arbitrarios en Apache Dolphinscheduler. Este problema afecta a Apache DolphinScheduler: versiones anteriores a 3.2.1. • http://www.openwall.com/lists/oss-security/2024/02/20/2 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50270 – Apache DolphinScheduler: Session do not expire after password change
https://notcve.org/view.php?id=CVE-2023-50270
20 Feb 2024 — Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue. Corrección de sesión de Apache DolphinScheduler anterior a la versión 3.2.0, cuya sesión sigue siendo válida después del cambio de contraseña. Se recomienda a los usuarios actualizar a la versión 3.2.1, que soluciona este problema. • https://github.com/apache/dolphinscheduler/pull/15219 • CWE-384: Session Fixation CWE-613: Insufficient Session Expiration •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49250 – Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil
https://notcve.org/view.php?id=CVE-2023-49250
20 Feb 2024 — Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which fixes the issue. Debido a que la clase HttpUtils no verificó los certificados, un atacante que pudiera realizar un ataque Man-in-the-Middle (MITM) en conexiones https salientes podría hacerse pasar por el servidor. ... • http://www.openwall.com/lists/oss-security/2024/02/20/1 • CWE-295: Improper Certificate Validation •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2023-49109 – Remote Code Execution in Apache Dolphinscheduler
https://notcve.org/view.php?id=CVE-2023-49109
20 Feb 2024 — Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue. Exposición de la ejecución remota de código en Apache Dolphinscheduler. Este problema afecta a Apache DolphinScheduler: versiones anteriores a 3.2.1. • http://www.openwall.com/lists/oss-security/2024/02/20/4 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.8EPSS: 1%CPEs: 2EXPL: 0CVE-2024-23952 – Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)
https://notcve.org/view.php?id=CVE-2024-23952
14 Feb 2024 — This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Este es un duplicado de CVE-2023-46104. • http://www.openwall.com/lists/oss-security/2024/02/14/2 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2023-39441 – Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation
https://notcve.org/view.php?id=CVE-2023-39441
23 Aug 2023 — Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 certificate. Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position. Users are strongly advised to upgrade to Apache Airflow... • http://www.openwall.com/lists/oss-security/2023/08/23/2 • CWE-295: Improper Certificate Validation •