| CVE-2022-40754 |
In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint
|
6.1
Medium
|
Sep 21, 2022 |
| CVE-2022-40604 |
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information…
|
7.5
High
|
Sep 21, 2022 |
| CVE-2022-38170 |
In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the…
|
Not rated
|
Sep 2, 2022 |
| CVE-2022-38054 |
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session…
|
Not rated
|
Sep 2, 2022 |
| CVE-2022-38362 |
Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated)…
|
Not rated
|
Aug 16, 2022 |
| CVE-2022-24288 |
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them…
|
Not rated
|
Feb 25, 2022 |
| CVE-2021-45229 |
It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query…
|
Not rated
|
Feb 25, 2022 |
| CVE-2021-45230 |
In Apache Airflow prior to 2.2.0
|
Not rated
|
Jan 20, 2022 |
| CVE-2021-38540 |
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3
|
Not rated
|
Sep 9, 2021 |
| CVE-2021-35936 |
If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of…
|
Not rated
|
Aug 16, 2021 |
| CVE-2021-28359 |
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit
|
Not rated
|
May 2, 2021 |
| CVE-2021-26697 |
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0
|
Not rated
|
Feb 17, 2021 |
| CVE-2021-26559 |
Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User…
|
Not rated
|
Feb 17, 2021 |
| CVE-2020-17526 |
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a…
|
Not rated
|
Dec 21, 2020 |
| CVE-2020-17511 |
In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text…
|
Not rated
|
Dec 14, 2020 |
| CVE-2020-17513 |
In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable…
|
Not rated
|
Dec 14, 2020 |
| CVE-2020-17515 |
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit
|
Not rated
|
Dec 11, 2020 |
| CVE-2020-9485 |
An issue was found in Apache Airflow versions 1.10.10 and below
|
Not rated
|
Jul 16, 2020 |
| CVE-2020-11983 |
An issue was found in Apache Airflow versions 1.10.10 and below
|
Not rated
|
Jul 16, 2020 |
| CVE-2020-11982 |
An issue was found in Apache Airflow versions 1.10.10 and below
|
Not rated
|
Jul 16, 2020 |
| CVE-2020-11981 |
An issue was found in Apache Airflow versions 1.10.10 and below
|
Not rated
|
Jul 16, 2020 |
| CVE-2020-11978 |
Exploited
Apache Airflow Command Injection
|
8.8
High
|
Jul 16, 2020 |
| CVE-2018-20244 |
In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database…
|
Not rated
|
Feb 27, 2019 |
| CVE-2018-20245 |
The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and…
|
Not rated
|
Jan 23, 2019 |
| CVE-2017-17835 |
In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of…
|
Not rated
|
Jan 23, 2019 |