553 matches found
CVE-2016-4950
Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions...
CVE-2016-4948
CVE-2016-4948 concerns multiple cross-site scripting (XSS) flaws in Cloudera Manager 5.5 and earlier. An attacker could inject arbitrary scripts via user-supplied input in (1) Template Name when renaming a template, (2) KDC Server host, (3) Kerberos Security Realm, (4) Kerberos Encryption Types, ...
CVE-2016-4949
CVE-2016-4949 affects Cloudera Manager 5.5 and earlier. A remote attacker could obtain sensitive information by manipulating the filename parameter in the logs endpoint /cmf/process//logs, supplying either “stderr.log” or “stdout.log”. The underlying issue is an information disclosure in the proc...
CVE-2016-4950
CVE-2016-4950 affects Cloudera Manager 5.5 and earlier. A remote attacker could enumerate user sessions by calling /api/v11/users/sessions, exposing active sessions information. Public descriptions confirm the issue is an access-control flaw in the sessions API. The IBM security bulletin maps CVS...
CVE-2016-4946
CVE-2016-4946 affects Cloudera Hue up to version 3.9.0, with multiple stored XSS in the HUE Users page (First name/Last name) and in group-name handling. The issue arises from unsanitized input fields allowing injection of script/HTML; exploitation is possible remotely and may require user intera...
CVE-2016-4946
Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...
CVE-2016-4949
Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a 1 stderr.log or 2 stdout.log value in the filename parameter to /cmf/process//logs...
CVE-2016-4947
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...
CVE-2016-4947
CVE-2016-4947 affects Cloudera HUE 3.9.0 and earlier, where a remote attacker can enumerate user accounts by sending a request to desktop/api/users/autocomplete. The impact is user enumeration via a publicly accessible endpoint; no exploit details are provided beyond the endpoint, and the connect...
CVE-2016-4949: Exposure of Sensitive Information to an Unauthorized Actor
Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a 1 stderr.log or 2 stdout.log value in the filename parameter to /cmf/process/ /logs...
CVE-2016-4948: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 Template Name field when renaming a template; 2 KDC Server host, 3 Kerberos Security Realm, 4 Kerberos Encryption Types, 5 Advanced...
CVE-2016-4947: Exposure of Sensitive Information to an Unauthorized Actor
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...
CVE-2016-4950: Exposure of Sensitive Information to an Unauthorized Actor
Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions...
PT-2017-8626
Name of the Vulnerable Software and Affected Versions Cloudera HUE versions 3.9.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the First name or Last name field in the HUE Users page, potentially leading to cross-site scripting XSS attacks...
PT-2017-8630
Name of the Vulnerable Software and Affected Versions Cloudera Manager versions 5.5 and earlier Description The issue allows remote attackers to enumerate user sessions. This can be achieved by sending a request to the "api/v11/users/sessions" endpoint. Recommendations For Cloudera Manager versio...
PT-2017-8628
Name of the Vulnerable Software and Affected Versions Cloudera Manager versions 5.5 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via several fields in the Kerberos wizard, including the Template Name field, KDC Server host, Kerberos Security...
CVE-2016-4946: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...
PT-2017-8627
Name of the Vulnerable Software and Affected Versions Cloudera HUE versions 3.9.0 and earlier Description The issue allows remote attackers to enumerate user accounts via a request to "desktop/api/users/autocomplete". This enables attackers to gather information about existing user accounts...
PT-2017-8629
Name of the Vulnerable Software and Affected Versions Cloudera Manager versions 5.5 and earlier Description The issue allows remote attackers to obtain sensitive information. This can be achieved by manipulating the filename parameter in the "/cmf/process//logs" endpoint, specifically by using a ...
