CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11983
https://notcve.org/view.php?id=CVE-2020-11983
16 Jul 2020 — An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks. Se encontró un problema en Apache Airflow versiones 1.10.10 y posteriores. Se detectó que muchas de las pantallas de gestión de administración en la UI new/RBAC manejaban el escape incorrectamente, permitiendo a usuarios autenticados con los permisos... • https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 15%CPEs: 1EXPL: 0CVE-2020-11982
https://notcve.org/view.php?id=CVE-2020-11982
16 Jul 2020 — An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker. Se encontró un problema en Apache Airflow versiones 1.10.10 y posteriores. Cuando se usa la función CeleryExecutor, si un ataque puede conectarse directamente al broker (Redis, RabbitMQ), era... • https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 91%CPEs: 1EXPL: 0CVE-2020-11981
https://notcve.org/view.php?id=CVE-2020-11981
16 Jul 2020 — An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands. Se encontró un problema en Apache Airflow versiones 1.10.10 y posteriores. Cuando se usa la función CeleryExecutor, si un atacante puede conectarse directamente al broker (Redis, RabbitMQ), es posible inyectar comandos, resultando que el trabajador de celer... • https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 94%CPEs: 1EXPL: 6CVE-2020-11978 – Apache Airflow Command Injection
https://notcve.org/view.php?id=CVE-2020-11978
16 Jul 2020 — An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable. Se encontró un problema en Apache Airflow versiones 1.10.10 y posteriores. Se ... • https://packetstorm.news/files/id/174764 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 4.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-12398
https://notcve.org/view.php?id=CVE-2019-12398
14 Jan 2020 — In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected. En Apache Airflow versiones anteriores a 1.10.5, cuando se ejecuta con la interfaz de usuario "clasic", un usuario administrador malicioso podía editar el estado de los objetos en la base de datos de metadatos de Airflow para ejecutar javascript arbitrario en determin... • http://www.openwall.com/lists/oss-security/2020/01/14/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12417
https://notcve.org/view.php?id=CVE-2019-12417
30 Oct 2019 — A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process. Un usuario administrador malicioso podría editar el estado de los objetos en la base de datos de metadatos de Airflow para ejecutar JavaScript arbitrario en determinadas vistas de página. Esto también presentó una vulnerabilidad de Divulgación de Archivos Local en... • https://lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc%40%3Cusers.airflow.apache.org%3E • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-0216
https://notcve.org/view.php?id=CVE-2019-0216
10 Apr 2019 — A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. Un usuario administrador malicioso podría editar el estado de los objetos en la base de datos metadata de Airflow para ejecutar JavaScript arbitrario en determinadas vistas de páginas. • http://www.openwall.com/lists/oss-security/2019/04/10/6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-0229
https://notcve.org/view.php?id=CVE-2019-0229
10 Apr 2019 — A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks. Varios endpoints HTTP en el webserver Airflow (tanto RBAC como clásico) no tenían la protección adecuada y eran vulnerables a los ataques de tipo cross-site request forgery (CSRF) • http://www.openwall.com/lists/oss-security/2019/04/10/6 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20244
https://notcve.org/view.php?id=CVE-2018-20244
27 Feb 2019 — In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. En Apache Airflow, en versiones anteriores a la 1.10.2, un administrador malicioso podría editar el estado de objetos en la base de datos de los metadatos de Airflow para ejecutar JavaScript arbitrario en determinadas vistas de páginas. • http://www.openwall.com/lists/oss-security/2019/04/10/6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17835
https://notcve.org/view.php?id=CVE-2017-17835
23 Jan 2019 — In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow. En Apache Airflow, en versiones 1.8.2 y anteriores, una vulnerabilidad de Cross-Site Request Forgery (CSRF) permitía la inyección remota de comandos en una instalación por defecto de Airflow. • https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.apache.org%3E • CWE-352: Cross-Site Request Forgery (CSRF) •