CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13922 – Apache DolphinScheduler (incubating) Permission vulnerability
https://notcve.org/view.php?id=CVE-2020-13922
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface. Las versiones de Apache DolphinScheduler anteriores a 1.3.2, permitían a un usuario normal bajo cualquier inquilino anular la contraseña de otro usuario por medio de la interfaz de la API • https://www.mail-archive.com/announce%40apache.org/msg06076.html • CWE-264: Permissions, Privileges, and Access Controls CWE-276: Incorrect Default Permissions •
CVSS: 9.8EPSS: 3%CPEs: 2EXPL: 0CVE-2020-11974
https://notcve.org/view.php?id=CVE-2020-11974
In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database. En DolphinScheduler versiones 1.2.0 y 1.2.1, con mysql connectorj se presenta una vulnerabilidad de ejecución de código remota al elegir mysql como base de datos • http://www.openwall.com/lists/oss-security/2024/04/09/8 https://lists.apache.org/thread.html/r0de5e3d5516467c9429a8d4356eca17ccf156337345ac6b104748acb%40%3Ccommits.dolphinscheduler.apache.org%3E https://lists.apache.org/thread.html/r33452d7b99a293bcf8f3e4bd664943847e2602e03a9e45d09d3f508a%40%3Ccommits.dolphinscheduler.apache.org%3E https://lists.apache.org/thread.html/r9fbe24539a873032b3e41243d44a730d6a2aae26335ac1e3271ea47d%40%3Ccommits.dolphinscheduler.apache.org%3E https://lists.apache.org/thread.html/ra81adacbfdd6f166f9cf155340674ffd4179386b8b75068639547c11%40%3Ccommits.dolphinscheduler •