CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51770 – Apache DolphinScheduler: Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2023-51770
Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue. Vulnerabilidad de lectura de archivos arbitrarios en Apache Dolphinscheduler. Este problema afecta a Apache DolphinScheduler: versiones anteriores a 3.2.1. Recomendamos a los usuarios que actualicen Apache DolphinScheduler a la versión 3.2.1, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/02/20/2 https://github.com/apache/dolphinscheduler/pull/15433 https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g https://lists.apache.org/thread/gpks573kn00ofxn7n9gkg6o47d03p5rw • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50270 – Apache DolphinScheduler: Session do not expire after password change
https://notcve.org/view.php?id=CVE-2023-50270
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue. Corrección de sesión de Apache DolphinScheduler anterior a la versión 3.2.0, cuya sesión sigue siendo válida después del cambio de contraseña. Se recomienda a los usuarios actualizar a la versión 3.2.1, que soluciona este problema. • https://github.com/apache/dolphinscheduler/pull/15219 https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r https://www.openwall.com/lists/oss-security/2024/02/20/3 • CWE-384: Session Fixation CWE-613: Insufficient Session Expiration •
CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49250 – Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil
https://notcve.org/view.php?id=CVE-2023-49250
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which fixes the issue. Debido a que la clase HttpUtils no verificó los certificados, un atacante que pudiera realizar un ataque Man-in-the-Middle (MITM) en conexiones https salientes podría hacerse pasar por el servidor. Este problema afecta a Apache DolphinScheduler: versiones anteriores a 3.2.0. Se recomienda a los usuarios actualizar a la versión 3.2.1, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/02/20/1 https://github.com/apache/dolphinscheduler/pull/15288 https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn • CWE-295: Improper Certificate Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49109 – Remote Code Execution in Apache Dolphinscheduler
https://notcve.org/view.php?id=CVE-2023-49109
Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue. Exposición de la ejecución remota de código en Apache Dolphinscheduler. Este problema afecta a Apache DolphinScheduler: versiones anteriores a 3.2.1. Recomendamos a los usuarios que actualicen Apache DolphinScheduler a la versión 3.2.1, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/02/20/4 https://github.com/apache/dolphinscheduler/pull/14991 https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo8ws4rr45vkn8 https://lists.apache.org/thread/6kgsl93vtqlbdk6otttl0d8wmlspk0m5 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23952 – Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)
https://notcve.org/view.php?id=CVE-2024-23952
This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Este es un duplicado de CVE-2023-46104. Con rangos de versión CVE correctos para Apache Superset afectado. • http://www.openwall.com/lists/oss-security/2024/02/14/2 http://www.openwall.com/lists/oss-security/2024/02/14/3 https://lists.apache.org/thread/zc58zvm4414molqn2m4d4vkrbrsxdksx • CWE-400: Uncontrolled Resource Consumption •