Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8Apache Airflow's Experimental API Authentication BypassPatch nowKEVEPSS 99.78%Nov 10, 2020
- Medium6.1In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.Check this weekEPSS 25.08%Sep 17, 2020
- Medium6.1CVE-2020-9485 is listed by An issue was found in Apache Airflow versions 1.10.10 and below..Check if you run itEPSS 2.76%Jul 17, 2020
- Medium5.4CVE-2020-11983 is listed by An issue was found in Apache Airflow versions 1.10.10 and below..Check if you run itEPSS 1.77%Jul 17, 2020
- Critical9.8CVE-2020-11982 is listed by An issue was found in Apache Airflow versions 1.10.10 and below..Check if you run itEPSS 7.22%Jul 17, 2020
- Critical9.8CVE-2020-11981 is listed by An issue was found in Apache Airflow versions 1.10.10 and below..Check this weekEPSS 36.79%Jul 17, 2020
- High8.8Apache Airflow Command InjectionPatch nowKEVEPSS 99.19%Jul 16, 2020
- Medium4.8In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute…Check if you run itEPSS 2.82%Jan 14, 2020
- Medium4.8CVE-2019-12417 is listed by A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page vie…Check if you run itEPSS 1.28%Oct 30, 2019
- High8.8A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.Check if you run itEPSS 1.56%Apr 10, 2019
- Medium4.8CVE-2019-0216 is listed by A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views..Check if you run itEPSS 2.66%Apr 10, 2019
- Medium5.5In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.Check if you run itEPSS 1.96%Feb 27, 2019
- High7.5The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which di…Check if you run itEPSS 1.02%Jan 23, 2019
- Critical9.8In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow.Check if you run itEPSS 3.19%Jan 23, 2019
- High8.8In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.Check if you run itEPSS 2.04%Jan 23, 2019
- High8.8In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.Check if you run itEPSS 2.53%Jan 23, 2019
- Medium6.1It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack.Check if you run itEPSS 2.02%Aug 6, 2018
Sort