Balis0Ng

The issue is related to improper access control in Apache Airflow, allowing an authenticated user without the variable edit permission to update a variable. This compromises the integrity of variable management and could lead to unauthorized data modification.

The issue allows an authenticated user with limited access to some DAGs to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus enabling the user to clear DAGs they shouldn't. This is related to a missing fix in Apache Airflow 2.7.2. The vulnerability is also associated with information disclosure in the error data area, which could allow a remote attacker to gain unauthorized access to the database.

The issue is related to insufficient protection of internal data in Apache Airflow, allowing an authorized user with limited access to read specific DAGs to also read information about task instances in other DAGs. This can lead to unauthorized access to protected information.

The issue allows an authorized user with access to read specific DAGs only to read information about task instances in other DAGs. This is due to a lack of protection for internal data. Exploitation of this issue may allow a remote attacker to gain read access to data.

The issue allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs, revealing the `dag ids` and the stack-traces of import errors for those DAGs with import errors.

The issue allows an authenticated user with limited access to some DAGs to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus enabling the user to clear DAGs they shouldn't. This is related to the disclosure of information in the error data area. Exploitation of the vulnerability may allow a remote attacker to impact data integrity.

The issue is related to the "Run Task" feature in Apache Airflow, which allows an authenticated user to bypass some restrictions and execute code in the webserver context, as well as access certain DAGs beyond their limitations. This feature is considered dangerous and has been removed entirely in Airflow 2.6.0. The vulnerability can lead to exposure of sensitive information to unauthorized actors.

The issue is related to a SQL injection in the Benutzerverwaltung component.

The issue affects the Mediamanager component in REDAXO, allowing for cross-site scripting (XSS) attacks.

The issue concerns the $opener input field variable in the addons/mediapool/pages/index.php file, which is not properly filtered and is directly output to the page. An attacker can exploit this by inserting XSS payloads via a request to the /index.php?page=mediapool/media&opener input field=[XSS] endpoint.

The issue concerns the $args variable in the addons/mediapool/pages/index.php file, where names are not restricted, allowing an attacker to insert XSS payloads. This can be achieved via the index.php?page=mediapool/media&opener input field=&args[substring] endpoint.

A critical SQL injection issue has been found in the rex list class due to the prepareQuery function in core/lib/list.php. This can be exploited via the "sort" parameter in the index.php?page=users/users API endpoint. The backend is affected, and the frontend is also vulnerable if rex list is used.