Id_No2015429

The issue is related to the exposure of sensitive information in Apache Airflow, which could allow a remote attacker to obtain confidential information.

The issue is related to improper input validation in Apache Airflow Drill Provider, allowing an attacker to pass malicious parameters when establishing a connection with DrillHook. This gives the attacker an opportunity to read files on the Airflow server.

The issue is related to improper input validation, which allows bypassing a security check, potentially leading to remote code execution (RCE) via the `principal` parameter. This can be exploited if an attacker has access to modify connection details.

The issue is related to insufficient input validation in the Apache Airflow MSSQL Provider and Airflow ODBC Provider modules. This allows a remote attacker to access protected information. The vulnerability is considered low because it requires DAG code to use `get sqlalchemy connection` and someone with access to connection resources to update the connection and exploit it.

The issue is related to an Improper Input Validation vulnerability in the Apache Airflow Hive Provider.

The issue is related to the improper neutralization of special elements used in a command, which can lead to command injection. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

The issue is related to an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Airflow Hive Provider. This vulnerability allows for command injection, which can lead to unauthorized execution of system commands.

The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection'. This allows an attacker to control commands executed in the task execution context without needing write access to DAG files.

The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This allows an attacker to execute arbitrary commands in the task execution context without needing write access to DAG files.

The issue is related to an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider. This allows an attacker to read arbitrary files in the task execution context without write access to DAG files.

The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This allows an attacker to control commands executed in the task execution context without needing write access to DAG files.

The issue concerns an XSS attack via the `origin` query argument in the "Trigger DAG with config" screen.