airflow vulnerabilities (Bitnami)
148 vulnerabilities.
airflowBitnamiApache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation5.9 MediumairflowBitnamiApache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" feature8.1 HighairflowBitnamiSession fixation in Apache Airflow web interface8.0 HighairflowBitnamiApache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges8.8 HighairflowBitnamiApache Airflow: Scheduler remote DoS6.5 MediumairflowBitnamiApache Airflow: ReDoS via dags function6.5 MediumairflowBitnamiApache Airflow: Security vulnerability on AirFlow Connections6.5 MediumairflowBitnamiApache Airflow path traversal by authenticated user6.5 MediumairflowBitnamiApache Airflow: Access to DAGs without relevant permission6.5 MediumairflowBitnamiApache Airflow: Information disclosure on configuration view6.5 MediumairflowBitnamiApache Airflow: Privilege escalation using airflow logs9.8 CriticalairflowBitnamiStored XSS on Apache Airflow5.4 MediumairflowBitnamiInformation disclosure in Apache Airflow5.3 MediumairflowBitnamiApache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow9.8 CriticalairflowBitnamiApache Airflow Hive Provider vulnerability (command injection via hive_cli connection)7.8 HighairflowBitnamiApache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files5.5 MediumairflowBitnamiApache Airlfow Pig Provider RCE9.8 CriticalairflowBitnamiApache Airflow Pinot provider allowed Command Injection9.8 CriticalairflowBitnamiApache Airflow: Open redirect during login6.1 MediumairflowBitnamiApache Airflow <2.4.0 has an RCE in a bash example8.8 HighairflowBitnamiApache Airflow prior to 2.3.1 may include sensitive values in rendered template7.5 HighairflowBitnamiApache Airflow prior to 2.4.2 has an open redirect6.1 MediumairflowBitnamiApache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL6.1 MediumairflowBitnamiSession still functional after user is deactivated8.1 HighairflowBitnamiOpen Redirect6.1 MediumairflowBitnamiFormat String Vulnerability7.5 HighairflowBitnamiOverly permissive umask for daemons4.7 MediumairflowBitnamiSession Fixation9.8 CriticalairflowBitnamiApache Airflow: RCE in example DAGs8.8 HighairflowBitnamiApache Airflow: Reflected XSS via Origin Query Argument in URL6.1 MediumairflowBitnamiApache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver6.5 MediumairflowBitnamiApache Airflow: Variable Import endpoint missed authentication check9.8 CriticalairflowBitnamiNo Authentication on Logging Server5.3 MediumairflowBitnamiObservable Response Discrepancy in Flask-AppBuilder5.3 MediumairflowBitnamiApache Airflow Reflected XSS via Origin Query Argument in URL6.1 MediumairflowBitnamiApache Airflow: Lineage API endpoint for Experimental API missed authentication check5.3 MediumairflowBitnamiCWE-284 Improper Access Control on Configurations Endpoint for the Stable API6.5 MediumairflowBitnamiIncorrect Session Validation in Apache Airflow7.7 HighairflowBitnamiSSRF vulnerability in Apache Airflow5.3 MediumairflowBitnamiApache Airflow logs passwords in plaintext6.5 MediumairflowBitnamiApache Airflow cross-site scripting due to incomplete fix for CVE-2020-139446.1 MediumairflowBitnamiAuthentication bypass in Apache Airflow9.8 CriticalairflowBitnamiApache Airflow Cross-site Scripting6.1 MediumairflowBitnamiStored XSS in Apache Airflow6.1 MediumairflowBitnamiMultiple stored XSS in RBAC Admin screens in Apache Airflow5.4 MediumairflowBitnamiInsecure default config of Celery worker in Apache Airflow9.8 CriticalairflowBitnamiCommand injection via Celery broker in Apache Airflow9.8 CriticalairflowBitnamiRemote code execution (RCE) in Apache Airflow8.8 High