CVE-2017-14797

The CVE-2017-14797 entry concerns Philips Hue Bridge BSB002 public API on firmware 1707040932, where a lack of transport encryption enables an attacker on the local intranet to sniff HTTP traffic and read API keys. This bypasses the pushlink protection and can, per cited sources, allow full contr...

PT-2017-13690

Name of the Vulnerable Software and Affected Versions Philips Hue Bridge BSB002 version 1707040932 Description The issue is related to a lack of transport encryption in the public API, allowing remote attackers to read API keys by sniffing HTTP traffic on the local intranet network. This can lead...

WS-2017-3759

Hue version release-4.0.0 is vulnerable to XSS attack through search query parameters...

Philips Hue gen 1 - Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Philips Hue gen 1 published at the 'play' market has multiple vulnerabilities...

Philips Hue - Corrupted files, Dangerous filesystem permissions, Exported components vulnerabilities

HackApp vulnerability scanner discovered that application Philips Hue published at the 'play' market has multiple vulnerabilities...

Cloudera HUE =< 3.9.0 Enumerating users with an unprivileged account (CVE-2016-4947)

Cloudera HUE =/desktop/api/users/autocomplete Open redirection Cloudera HUE =:8888/accounts/login/?next=//google.fr...

Cloudera HUE =< 3.9.0 is vulnerable to multiple stored XSS (CVE-2016-4946)

Cloudera HUE = 3.9.0 is vulnerable to multiple stored XSS: In the Username, First name and Last name fields of a user profile. This can be triggered while logging in with the account. In the Group Name field of group creation. This can be triggered when sharing an item...

Cloudera HUE Session cookies stored in the database

User session cookies are stored in the database. Combined with the vulnerability related to configuration file which is world readable, it is possible to spoof a user across the entire cluster launching jobs and browsing the datalake, without having to crack password hashes. Cookies are stored in...

Cloudera HUE Configuration file world readable

The hue.ini configuration file is by default accessible to anyone with the other permission set to read: $ ls -al /etc/hue/conf/hue.ini -rw-rw-r-- 1 root root 22813 Nov 18 2015 /etc/hue/conf/hue.ini Several account credentials can be found in that configuration file such as: Database account: thi...

CVE-2016-4947

Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...

CVE-2016-4946

Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...

CVE-2016-4947

Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...

Cross site request forgery (csrf)

Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...

CVE-2016-4946

Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...

CVE-2016-4947

CVE-2016-4947 affects Cloudera HUE 3.9.0 and earlier, where a remote attacker can enumerate user accounts by sending a request to desktop/api/users/autocomplete. The impact is user enumeration via a publicly accessible endpoint; no exploit details are provided beyond the endpoint, and the connect...

CVE-2016-4947

Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...

CVE-2016-4946

CVE-2016-4946 affects Cloudera Hue up to version 3.9.0, with multiple stored XSS in the HUE Users page (First name/Last name) and in group-name handling. The issue arises from unsanitized input fields allowing injection of script/HTML; exploitation is possible remotely and may require user intera...

CVE-2016-4946

Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...

PT-2017-8627

Name of the Vulnerable Software and Affected Versions Cloudera HUE versions 3.9.0 and earlier Description The issue allows remote attackers to enumerate user accounts via a request to "desktop/api/users/autocomplete". This enables attackers to gather information about existing user accounts...