CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31066 – Apache InLong: Insecure direct object references for inlong sources
https://notcve.org/view.php?id=CVE-2023-31066
Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Different users in InLong could delete, edit, stop, and start others' sources! Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7775 https://github.com/apache/inlong/pull/7775 to solve it. • https://lists.apache.org/thread/x7y05wo37sq5l9fnmmsjh2dr9kcjrcxf • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 9.8EPSS: 4%CPEs: 1EXPL: 0CVE-2023-31098 – Apache InLong: Weak Password Implementation in InLong
https://notcve.org/view.php?id=CVE-2023-31098
Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0. When users change their password to a simple password (with any character or symbol), attackers can easily guess the user's password and access the account. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7805 https://github.com/apache/inlong/pull/7805 to solve it. • https://lists.apache.org/thread/1fvloc3no1gbffzrcsx9ltsg08wr2d1w • CWE-521: Weak Password Requirements •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-31101 – Apache InLong: Users who joined later can see the data of deleted users
https://notcve.org/view.php?id=CVE-2023-31101
Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0. Users registered in InLong who joined later can see deleted users' data. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 to solve it. • https://lists.apache.org/thread/shvwwr6toqz5rr39rwh4k03z08sh9jmr • CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31103 – Apache InLong: Attackers can change the immutable name and type of cluster
https://notcve.org/view.php?id=CVE-2023-31103
Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of cluster of InLong. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7891 https://github.com/apache/inlong/pull/7891 to solve it. • https://lists.apache.org/thread/bv51zhjookcnfbz8b0xsl9wv78sn0j1p • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31206 – Apache InLong: Attackers can change the immutable name and type of nodes
https://notcve.org/view.php?id=CVE-2023-31206
Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of nodes of InLong. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it. [1] https://cveprocess.apache.org/cve5/[1]%C2%A0https://github.com/apache/inlong/pull/7891 https://github.com/apache/inlong/pull/7891 https://github.com/apache/inlong/pull/7891 • https://lists.apache.org/thread/qb7zffo785wzpmsobjqcypodngw6kg6x • CWE-668: Exposure of Resource to Wrong Sphere •