CVSS: 9.8EPSS: 96%CPEs: 1EXPL: 3CVE-2024-27348 – Apache HugeGraph-Server Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2024-27348
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue. Vulnerabilidad de ejecución remota de comandos RCE en Apache HugeGraph-Server. Este problema afecta a Apache HugeGraph-Server: desde 1.0.0 antes de 1.3.0 en Java8 y Java11. Se recomienda a los usuarios actualizar a la versión 1.3.0 con Java11 y habilitar el sistema de autenticación lo que soluciona el problema. Apache HugeGraph versions 1.0.0 and up to 1.3.0 suffer from a remote command execution vulnerability. • https://github.com/Zeyad-Azima/CVE-2024-27348 https://github.com/kljunowsky/CVE-2024-27348 https://github.com/jakabakos/CVE-2024-27348-Apache-HugeGraph-RCE http://www.openwall.com/lists/oss-security/2024/04/22/3 https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9 • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27347 – Apache HugeGraph-Hubble: SSRF in Hubble connection page
https://notcve.org/view.php?id=CVE-2024-27347
Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue. Vulnerabilidad de Server-Side Request Forgery (SSRF) en Apache HugeGraph-Hubble. Este problema afecta a Apache HugeGraph-Hubble: desde 1.0.0 antes de 1.3.0. Se recomienda a los usuarios actualizar a la versión 1.3.0, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/04/22/2 https://lists.apache.org/thread/z0v71148slfkw60hsp35pl7ddjyvg01l • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 2.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29733 – Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context
https://notcve.org/view.php?id=CVE-2024-29733
Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly. This issue affects Apache Airflow FTP Provider: before 3.7.0. Users are recommended to upgrade to version 3.7.0, which fixes the issue. Vulnerabilidad de validación de certificado incorrecta en el proveedor FTP Apache Airflow. El enlace FTP carece de una validación completa del certificado en las conexiones FTP_TLS, lo que potencialmente puede aprovecharse. La implementación de una validación de certificados adecuada pasando context=ssl.create_default_context() durante la creación de instancias de FTP_TLS se utiliza como mitigación para validar los certificados correctamente. • http://www.openwall.com/lists/oss-security/2024/04/19/3 https://docs.python.org/3/library/ssl.html#best-defaults https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280 https://github.com/apache/airflow/pull/38266 https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2 • CWE-295: Improper Certificate Validation •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29217 – Apache Answer: XSS vulnerability when changing personal website
https://notcve.org/view.php?id=CVE-2024-29217
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue. Neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web ('cross-site Scripting') en Apache Answer. Este problema afecta a Apache Answer: versiones anteriores a 1.3.0. Ataque XSS cuando el usuario cambia de sitio web personal. • http://www.openwall.com/lists/oss-security/2024/04/19/1 https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31869 – Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
https://notcve.org/view.php?id=CVE-2024-31869
Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page. Las versiones 2.7.0 a 2.8.4 de Airflow tienen una vulnerabilidad que permite a un usuario autenticado ver la configuración confidencial del proveedor a través de la página de interfaz de usuario "configuración" cuando se configuró "solo no confidencial" como configuración "webserver.expose_config" (el proveedor de apio es el único proveedor comunitario actualmente que tiene configuraciones confidenciales). Deberías migrar a Airflow 2.9 o cambiar tu configuración "expose_config" a False como workaround. • http://www.openwall.com/lists/oss-security/2024/04/17/10 https://github.com/apache/airflow/pull/38795 https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •