denr.gov.ph Cross Site Scripting vulnerability OBB-1979673

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| denr.gov.ph ---|--- Open Bug Bounty...

org.apache.nifi:nifi-cluster-authorization-provider (0.3.0), org.apache.nifi:nifi-framework-cluster (0.3.0) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.3.0)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.3.0 -...

org.apache.nifi:nifi-cluster-authorization-provider (0.4.0), org.apache.nifi:nifi-framework-cluster (0.4.0) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.4.0)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.4.0 -...

org.apache.nifi:nifi-cluster-authorization-provider (0.6.0), org.apache.nifi:nifi-framework-cluster (0.6.0) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.6.0)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.6.0 -...

org.apache.nifi:nifi-cluster-authorization-provider (0.0.1-incubating), org.apache.nifi:nifi-framework-cluster (0.0.1-incubating) +5 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.0.1-incubating)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.0.1-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider...

CVE-2017-15703

Apache NiFi (1.x) is affected by CVE-2017-15703 where an authenticated user with a valid client certificate and without ACL permissions can upload a template containing malicious Java deserialization code, leading to a denial-of-service. The root cause is improper handling of Java deserialization...

org.apache.nifi.minifi:minifi-c2-assembly (>=0.2.0, <=0.3.0), org.apache.nifi.minifi:minifi-c2-provider-nifi-rest (>=0.2.0, <=0.3.0) +17 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (>=0.0.1-incubating, <=1.4.0)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version =0.0.1-incubating, =0.2.0, =0.2.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0-beta, =0.0.1-incubating, =1.0.0-beta, =0.0.1-incubating, =0.0.1-incubating, =0.0.1-incubating, =0.0.1-incubating, =1.2.0, =1.4.0 and more Source cves:...