Sw0Rd1Ight

The software contains a flaw that permits authenticated users possessing audit log access to view sensitive values within audit logs that they are not authorized to see. Specifically, when sensitive connection parameters were established through the Airflow command-line interface (CLI), the values of these variables were exposed in the audit log and stored unencrypted within the Airflow database. This risk is confined to users with audit log access. The issue concerns connection secrets not being masked in the user interface when connections are added via the CLI.

An improper resource shutdown or release issue exists in Apache Tomcat. During a multipart upload, if an error occurs (including exceeding limits), temporary copies of the uploaded parts written to disc were not immediately cleaned up. These copies were left for garbage collection. Depending on JVM settings, application memory usage, and application load, the space for these temporary copies could be filled faster than garbage collection could clear it, potentially leading to a denial-of-service (DoS) condition.

A SQL injection issue exists in Django’s QuerySet methods—specifically `annotate()`, `alias()`, `aggregate()`, and `extra()`—when using a crafted dictionary with dictionary expansion as the `kwargs` passed to these methods on MySQL and MariaDB databases. The issue affects column aliases.

The `html.parser.HTMLParser` class contains a flaw where processing certain crafted malformed inputs results in worst-case quadratic complexity. This occurs due to the use of a regular expression with inefficient computational complexity, which can lead to CPU exhaustion and an amplified denial-of-service.

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request, for those requests with an invalid request-line, the spec recommends to reject them with 400 or 301. On Node and Bun, those requests are not rejected internally and are passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check. Only apps explicitly exposing the Vite dev server to the network and running the Vite dev server on runtimes that are not Deno (e.g., Node, Bun) are affected. Over 130,000 services are potentially affected.

An issue was discovered where the NFKC normalization is slow on Windows, making certain views subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. The affected views include `django.contrib.auth.views.LoginView`, `django.contrib.auth.views.LogoutView`, and `django.views.i18n.set language`.

A potential denial-of-service attack can occur when the django.utils.text.wrap() method and wordwrap template filter are used with very long strings.

This issue involves path equivalence where the use of an internal dot in a filename allows an unauthenticated remote attacker to bypass security checks. By sending a specially crafted PUT request containing a base64-encoded serialized Java payload, an attacker can upload arbitrary files to the server. If the application uses file-based session persistence with the default storage location, the attacker can then send a GET request with a `JSESSIONID` cookie pointing to the uploaded file, forcing the server to deserialize the data and execute arbitrary code. This flaw is under active exploitation in the wild. Exploitation may occur under the following conditions: - Writes are enabled for the Default Servlet (disabled by default). - Support for partial PUT is enabled (enabled by default). - For information disclosure: a target URL for sensitive uploads is a sub-directory of a public upload URL, and the attacker knows the sensitive filenames. - For remote code execution: the application uses file-based session persistence and includes a library susceptible to a deserialization attack.

The issue allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This requires the provider to be installed on the web server and the user to click the provider link.

The issue is related to errors in handling input data in the Oracle WebLogic Server Core component. This can be exploited by a remote attacker to execute arbitrary code by injecting specially crafted messages via T3 and IIOP protocols. Successful attacks can result in the takeover of the Oracle WebLogic Server.

The issue allows an attacker to pass in malicious parameters when establishing a connection, giving an opportunity to read files on the Airflow server.

The issue is related to improper input validation in Apache Airflow Drill Provider, allowing an attacker to pass malicious parameters when establishing a connection with DrillHook. This gives the attacker an opportunity to read files on the Airflow server.

The issue affects Apache InLong, allowing an attacker to bypass the current logic and achieve arbitrary file reading by exploiting a deserialization of untrusted data vulnerability. This could enable a remote attacker to read files arbitrarily.

The issue is related to the deserialization of untrusted data, which allows attackers to bypass the `autoDeserialize` option filtering by adding blanks. This can potentially lead to the execution of arbitrary code.

The issue allows an unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. This is due to insufficient input validation in the Core component.

The issue is related to the lack of effective filtering of parameters in Apache Linkis, which can lead to a deserialization vulnerability. This vulnerability can be triggered by an attacker configuring malicious Mysql JDBC parameters in the JDBC EngineConn Module, resulting in remote code execution. The parameters in the Mysql JDBC URL should be blacklisted to prevent exploitation.

The issue arises because parameters are not effectively filtered in Apache Linkis, allowing an attacker to use the MySQL data source and malicious parameters to configure a new data source. This triggers a deserialization vulnerability, eventually leading to remote code execution.

The issue is related to improper control of generation of code, also known as 'Code Injection'. This allows a remote attacker to execute arbitrary code.