1167 matches found
asf__nifi_CVE-2023-36542_1-22-0
Apache NiFi Status Resources Contacts !Track Issueshttps://img...
CVE-2023-34468
CVE-2023-34468: Remote Code Execution via DB Components in Apache NiFi The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code...
My-Exploits
My-Exploits Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of...
asf__nifi_CVE-2023-34468_1-21-00
nifi Apache NiFi is an easy to use, powerful, and reliable system to process and distribute data. Table of Contents Features Requirements Getting Started MiNiFi subproject Registry subproject Getting Help Documentation License Export Control Features Apache NiFi was made for dataflow. It supports...
Apache NiFi - Information Disclosure
Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...
apache__nifi_CVE-2022-33140_1-16-22
Apache NiFi Status Resources Contacts !Track Issueshttps://img...
CVE-2023-34468-PoC
CVE-2023-34468 PoC for Apache NiFi Educational proof-of-concept PoC for CVE-2023-34468 affecting Apache NiFi versions prior to 1.22.0. This repository demonstrates how abuse of H2 JDBC URL configuration can lead to authenticated remote code execution RCE in vulnerable Apache NiFi installations...
CVE-2023-34468
CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC Short Python PoC for abusing an editable Apache NiFi ExecuteSQL processor with an H2 RUNSCRIPT payload to trigger remote command execution through a Bash reverse shell. For authorized testing and research only. Do not use against system...
CLEANSTART-2026-SU09873 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...
Security vulnerability affects the apache-nifi package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth...
CLEANSTART-2026-KN06820 Information exposure vulnerability has been identified in Apache Kafka
Security vulnerability affects the apache-nifi package. Information exposure vulnerability has been identified in Apache Kafka...
CLEANSTART-2026-FS57151 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition
Security vulnerability affects the apache-nifi package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...
CLEANSTART-2026-BT04597 Apache MINA's AbstractIoBuffer
Security vulnerability affects the apache-nifi package. Apache MINA's AbstractIoBuffer...
CLEANSTART-2026-HQ66440 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)
Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...
CVE-2026-106449 vulnerabilities
Vulnerabilities for packages: spark, apicurio-registry-fips, elasticsearch-fips, strimzi-kafka-operator, wazuh-indexer, cassandra-reaper, logstash, automq-fips, cassandra, cruise-control, apache-hop, apache-pulsar, akhq, pinot-fips, knative-kafka-broker-fips, opensearch-fips, apache-hop-fips,...
CVE-2026-106450 vulnerabilities
Vulnerabilities for packages: spark, apicurio-registry-fips, elasticsearch-fips, strimzi-kafka-operator, wazuh-indexer, cassandra-reaper, logstash, automq-fips, cassandra, cruise-control, apache-hop, apache-pulsar, akhq, pinot-fips, knative-kafka-broker-fips, opensearch-fips, apache-hop-fips,...
GHSA-343H-94H5-C4WR vulnerabilities
Vulnerabilities for packages: spark, apicurio-registry-fips, elasticsearch-fips, strimzi-kafka-operator, wazuh-indexer, cassandra-reaper, logstash, automq-fips, cassandra, cruise-control, apache-hop, apache-pulsar, akhq, pinot-fips, knative-kafka-broker-fips, opensearch-fips, apache-hop-fips,...
GHSA-GM45-99XC-R7WV vulnerabilities
Vulnerabilities for packages: spark, apicurio-registry-fips, elasticsearch-fips, strimzi-kafka-operator, wazuh-indexer, cassandra-reaper, logstash, automq-fips, cassandra, cruise-control, apache-hop, apache-pulsar, akhq, pinot-fips, knative-kafka-broker-fips, opensearch-fips, apache-hop-fips,...
GHSA-J9F9-W8PJ-32F8 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry, datahub-gms...