CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-4032 – Incorrect IPv4 and IPv6 private ranges
https://notcve.org/view.php?id=CVE-2024-4032
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior. El módulo "ipaddress" contenía información incorrecta sobre si ciertas direcciones IPv4 e IPv6 estaban designadas como "accesibles globalmente" o "privadas". Esto afectó las propiedades is_private e is_global de las clases ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address y ipaddress.IPv6Network, donde los valores no se devolverían de acuerdo con la información más reciente de los Registros de direcciones de propósito especial de la IANA. CPython 3.12.4 y 3.13.0a6 contienen información actualizada de estos registros y, por lo tanto, tienen el comportamiento previsto. • http://www.openwall.com/lists/oss-security/2024/06/17/3 https://github.com/python/cpython/commit/22adf29da8d99933ffed8647d3e0726edd16f7f8 https://github.com/python/cpython/commit/40d75c2b7f5c67e254d0a025e0f2e2c7ada7f69f https://github.com/python/cpython/commit/895f7e2ac23eff4743143beef0f0c5ac71ea27d3 https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb https://github.com/python/cpython/commit/c62c9e518b784fe44432a3f4fc265fb95b651906 https://github.com/python/cpython/commit/f86b17ac511e68192ba71f27e752321a3252cee3 https://github.com • CWE-440: Expected Behavior Violation CWE-697: Incorrect Comparison •
CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25142 – Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache
https://notcve.org/view.php?id=CVE-2024-25142
Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue. Uso de la vulnerabilidad de caché del navegador web que contiene información confidencial en Apache Airflow. Airflow no devolvió el encabezado "Cache-Control" para contenido dinámico, lo que en el caso de algunos navegadores podría resultar en el almacenamiento de datos confidenciales en la caché local del navegador. Este problema afecta a Apache Airflow: antes de 2.9.2. Se recomienda a los usuarios actualizar a la versión 2.9.2, que soluciona el problema. • https://github.com/apache/airflow/pull/39550 https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr • CWE-525: Use of Web Browser Cache Containing Sensitive Information •
CVSS: -EPSS: 6%CPEs: 1EXPL: 0CVE-2024-36265 – Apache Submarine Server Core: authorization bypass
https://notcve.org/view.php?id=CVE-2024-36265
Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Vulnerabilidad de autorización incorrecta en Apache Submarine Server Core. Este problema afecta a Apache Submarine Server Core: desde 0.8.0. Como este proyecto está retirado, no planeamos lanzar una versión que solucione este problema. • http://www.openwall.com/lists/oss-security/2024/06/12/3 https://lists.apache.org/thread/prckhhst19qxof064hsm8cccxtofvflz • CWE-863: Incorrect Authorization •
CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36264 – Apache Submarine Commons Utils: default secret
https://notcve.org/view.php?id=CVE-2024-36264
Improper Authentication vulnerability in Apache Submarine Commons Utils. This issue affects Apache Submarine Commons Utils: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Vulnerabilidad de autenticación incorrecta en Apache Submarine Commons Utils. Este problema afecta a Apache Submarine Commons Utils: desde 0.8.0. Como este proyecto está retirado, no planeamos lanzar una versión que solucione este problema. • http://www.openwall.com/lists/oss-security/2024/06/12/2 https://github.com/apache/submarine/pull/1125 https://lists.apache.org/thread/7mo0c7vbhpo8thvybl8wwvb0bccrg7r4 • CWE-287: Improper Authentication •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36263 – Apache Submarine Server Core: SQL injection
https://notcve.org/view.php?id=CVE-2024-36263
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Neutralización inadecuada de elementos especiales utilizados en una vulnerabilidad de comando SQL ("inyección SQL") en Apache Submarine Server Core. Este problema afecta a Apache Submarine Server Core: todas las versiones. Como este proyecto está retirado, no planeamos lanzar una versión que solucione este problema. • http://www.openwall.com/lists/oss-security/2024/06/12/1 https://github.com/apache/submarine/pull/1121 https://lists.apache.org/thread/8q9kbdg9gk9kpz5p8x6t7q8709l3vrmt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •