Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the HDFS layer are now fixed in 5.2.3.3 or higher (CVE-2021-23445)

Summary The following vulnerabilities, which can affect IBM Storage Scale and the HDFS layer and could provide weaker-than-expected security, are now fixed in Storage Scale 5.2.3.3 or higher CVE-2021-23445. Vulnerability Details CVEID:CVE-2021-23445 DESCRIPTION: This affects the package...

EUVD-2019-0344

Malware in sbrugna...

EUVD-2015-1994

Malware in sbrugna...

EUVD-2022-4816

Malicious code in bioql PyPI...

EUVD-2022-4996

Malicious code in bioql PyPI...

EUVD-2022-3221

Malicious code in bioql PyPI...

EUVD-2023-2432

Malicious code in bioql PyPI...

EUVD-2022-3045

Malicious code in bioql PyPI...

EUVD-2022-3441

Malicious code in bioql PyPI...

CVE-2025-54460 AVEVA PI Integrator Unrestricted Upload of File with Dangerous Type

The vulnerability, if exploited, could allow an authenticated miscreant with privileges to create or access publication targets of type Text File or HDFS to upload and persist files that could potentially be executed...

CVE-2025-54460: Unrestricted Upload of File with Dangerous Type

The vulnerability, if exploited, could allow an authenticated miscreant with privileges to create or access publication targets of type Text File or HDFS to upload and persist files that could potentially be executed...

Fedora: Security Advisory (FEDORA-2023-791e2dc6cb)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple vulnerabilities in moment.js affect IBM Storage Scale

Summary There are multiple vulnerabilities in moment.js, used by IBM Storage Scale HDFS transparency, which can cause a denial of service or allow a remote attacker to traverse directories on the system. CVE-2017-18214, CVE-2022-24785, CVE-2016-4055, CVE-2022-31129. Vulnerability Details...

Security Bulletin: Multiple vulnerabilities in jquery affect IBM Storage Scale

Summary There are multiple vulnerabilities in jquery, used by IBM Storage Scale HDFS transparency, which could allow cross-site scripting, caused by improper validation of user-supplied input. Vulnerability Details CVEID:CVE-2012-6708 DESCRIPTION: jQuery is vulnerable to cross-site scripting,...

Security Bulletin: Common Vulnerabilities in Cloudera Data Platform Private Cloud Base 7.1.9.

Summary Common vulnerabilities reported in Cloudera Data Platform Private Cloud Base 7.1.9 have been addressed, and are available in Hotfix 2. Vulnerability Details CVEID:CVE-2015-1772 DESCRIPTION: Apache Hive could allow a remote attacker to bypass security restrictions, caused by an error in th...

Fedora 40 : golang-github-colinmarc-hdfs-2 (2023-791e2dc6cb)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-791e2dc6cb advisory. Automatic update for golang-github-colinmarc-hdfs-2-2.4.0-1.fc40. Changelog Thu Oct 12 2023 Mikel Olasagasti Uranga - 2.4.0-1 - Update to 2.4.0 - Closes...

Fedora 40 : golang-cloud-google / golang-cloud-google-bigquery / etc (2023-f23d9c5057)

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-f23d9c5057 advisory. Split golang-cloud-google into multiple modules Tenable has extracted the preceding description block directly from the Fedora security advisory. No...

Arbitrary Code Execution

Apache airflow hdfs provider package is found to be vulnerable to code execution. Incorrect documentation points users to install an incorrect pip package. Since this package is unverified, an attacker can claim this package and provide code that would be executed when this package was installed...

The vulnerability of the network-based software for automating data processing tasks in HDFS and Apache Airflow’s HDFS Provider lies in the fact that functions from an unverified controlled area are enabled, allowing attackers to load arbitrary packages.

The vulnerability of the network-based software for automating data processing tasks in HDFS and Apache Airflow’s HDFS Provider is related to the inclusion of functions from an unverified controlled area during the processing of PyPI package names. Exploiting this vulnerability allows a malicious...

GHSA-5HJ9-M76G-XRC8 Apache HDFS Provider error message suggested

In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The...