CVE-2018-11649: Improper Neutralization of Input During Web Page Generation

Hue 3.12 has XSS via the /pig/save/ name and script parameters...

PT-2018-10730

Name of the Vulnerable Software and Affected Versions Hue version 3.12 Description The issue is related to a security problem where an attacker can execute malicious scripts. This is achieved through the /pig/save/ endpoint, specifically by manipulating the name and script parameters...

CVE-2015-8094

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...

Open redirect

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...

CVE-2015-8094

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...

CVE-2015-8094

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...

CVE-2015-8094

CVE-2015-8094 is an open redirect vulnerability in Cloudera Hue prior to 3.10.0. The issue allows remote attackers to redirect users to arbitrary sites and conduct phishing via a URL supplied in the next parameter. Affected software: Cloudera Hue before 3.10.0. Root cause and exploit details are ...

PT-2018-4438

Name of the Vulnerable Software and Affected Versions Cloudera HUE versions prior to 3.10.0 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter. This can be exploited by including a malicious URL in th...

CVE-2015-8094: URL Redirection to Untrusted Site

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...

Hijacking Philips Hue

We were filming a smart home hacking piece on the 5th May this year. Like most home users, the Wi-Fi PSK wasn’t strong enough, so we cracked it and joined the network. The user had a Philips Hue lighting system. None of us here had looked at Hue before - we made an assumption after the previous...

WS-2018-0634

In “Cloudera/Hue”, cdh5.12.0 to cdh5.13.2, cdh5.14.0 and v4.0.0 to v4.1.0 are vulnerable against XSS in Hue Admin Interface...

WS-2018-0635

In “Cloudera/Hue”, v2.0.0 to v4.2.0, cdh4.0.0 to cdh5.14.0 and cdh4-base-2.0.0 to cdh4-base-2.5.0 are vulnerable as a result of an exposed LDAP password returned as ‘args’...

WS-2017-3763

In “Cloudera/Hue”, versions v3.11.0 to v4.1.0 and cdh5.9.0-rc1 to cdh5.12.1-release are vulnerable to XSS in the table row display modal, HueData table and TableExtender2...

WS-2017-3762

In “Cloudera/Hue”, cdh5.4.0 to cdh5.13.0 and v3.8.0 to v4.1.0, are vulnerable against XSS via the default html binding...

WS-2017-3761

In “Cloudera/Hue”, versions 4.0.0 to 4.1.0 and cdh5.13.0-rc1 to cdh5.13.0-release are vulnerable to xss in the wysiwyg5 editor...

CVE-2017-14797

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...

CVE-2017-14797

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...

Design/Logic Flaw

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...

CVE-2017-14797: Inadequate Encryption Strength

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...

CVE-2017-14797

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...