Apache Software Foundation DolphinScheduler

In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.

Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability

Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin

Remote Code Execution in Apache Dolphinscheduler

Apache DolphinScheduler: Remote Code Execution Vulnerability

Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure

Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.

Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks

Apache DolphinScheduler: Resource File Read And Write Vulnerability

DolphinScheduler mysql jdbc connector parameters deserialize remote code execution

Apache DolphinScheduler: Arbitrary js execute as root for authenticated users

Apache DolphinScheduler: Arbitrary js execution as root for authenticated users

Apache DolphinScheduler: RCE by arbitrary js execution

Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens

Apache DolphinScheduler: Alert Script Attack

Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.

Apache DolphinScheduler user registration is vulnerable to ReDoS attacks

Apache DolphinScheduler config file read by task risk

Apache DolphinScheduler: Arbitrary File Read Vulnerability

Apache dolphinscheduler sensitive information disclosure

Apache DolphinScheduler: Information Leakage Vulnerability

Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.

Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil

Apache DolphinScheduler (incubating) Permission vulnerability

Apache DolphinScheduler exposes files without authentication

Apache DolphinScheduler prior to 3.0.0 allows path traversal

Apache DolphinScheduler: Session do not expire after password change

Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for

Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.

Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.

Apache DolphinScheduler: Deserialization of untrusted data in RPC

Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication