Apache DolphinScheduler: Command Injection in the Alert Script Plugin

Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens

Apache DolphinScheduler: Alert Script Attack

Apache DolphinScheduler: RCE by arbitrary js execution

Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint

Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint

Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.

Apache DolphinScheduler: Resource File Read And Write Vulnerability

Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.

Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials

Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords