309 matches found
PT-2017-8626
Name of the Vulnerable Software and Affected Versions Cloudera HUE versions 3.9.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the First name or Last name field in the HUE Users page, potentially leading to cross-site scripting XSS attacks...
CVE-2016-4947: Exposure of Sensitive Information to an Unauthorized Actor
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...
CVE-2016-4946: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...
WS-2016-7102
In “Cloudera/Hue”, v2.3.0 to v3.11.0 are vulnerable against XSS as a result of an unescaped ‘name’ field...
WS-2016-7097
In “Cloudera/Hue”, cdh5.5.0 to cdh5.9.3 and v3.6.0 to v3.11.0 are vulnerable against XSS injection due to an unescaped Solr Data...
WS-2016-7098
In “Cloudera/Hue”, versions 3.10.0 to 3.11.0 and cdh5.7.0-pr1 to cdh5.9.3-release are vulnerable to XSS in the viewmodel options...
WS-2016-7095
Hue versions 3.10.0 to 3.11.0 and cdh5.7.0-pr1 to cdh5.9.3-release is vulnerable to XSS in the viewmodel options...
WS-2016-7096
Hue versions 3.6.0 to 3.11.0 and cdh5.0.0-release to cdh5.9.3-release is vulnerable to open redirect in onsuccessurl...
WS-2016-7099
Hue versions 3.6.0 to 3.11.0 and cdh5.0.0-release to cdh5.9.3-release is vulnerable to open redirect in onsuccessurl...
Cloudera HUE User Enumeration Vulnerability
Cloudera Hue is an open source Apache Hadoop UI system from the U.S. company Cloudera. A user enumeration vulnerability exists in Cloudera HUE. A remote attacker can exploit the vulnerability to gain access to the enumerated database users...
Cloudera HUE HTML Injection Vulnerability
Cloudera Hue is an open source Apache Hadoop UI system from the U.S. company Cloudera. Cloudera HUE suffers from an HTML injection vulnerability. An attacker can exploit the vulnerability to steal cookie-based authentication and execute arbitrary HTML or script code...
WS-2016-7094
Hue versions cdh5.4.0-rc1 to cdh5.8.5-release and release-3.8.0 to release-3.11.0 is vulnerable to XSS when hovering on saved query description...
WS-2016-7103
In “Cloudera/Hue”, versions 3.6.0 to 3.11.0 and cdh5.0.0-Release to cdh5.8.1-release are vulnerable to XSS in beeswax old editor...
WS-2016-7104
In “Cloudera/Hue”, versions v0.9.1 to v3.10.0, web server information is disclosed in the HTTP request header...
WS-2016-7101
In “Cloudera/Hue”, versions 3.5.0 to 3.10.0 and cdh5.0.0-Release to cdh5.8.5-release are vulnerable to XSS in DBQuery editor...
WS-2016-7100
In “Cloudera/Hue”, versions 3.8.0 to 3.9.0 and cdh5-base-3.8.0 to cdh5-base-3.9.0 are vulnerable to DOM based XSS...
Talk to HUE Trial - Customized SSL, Dangerous filesystem permissions, Insecure KeyStore vulnerabilities
HackApp vulnerability scanner discovered that application Talk to HUE Trial published at the 'play' market has multiple vulnerabilities...
WS-2015-0066
Hue versions cdh5-base-3.7.0 to cdh5-base-3.9.0, cdh5.4.0-rc1 to cdh5.4.9-release and release-2.3.0 to release-3.9.0 is vulnerable to XSS in jHueNotify and UserAdmin...
Hue /usr/lib/hue/build/env/bin/supervisor insecure privilege setting vulnerability
Hue is an open source Apache Hadoop UI system. Hue /usr/lib/hue/build/env/bin/supervisor fails to set permissions correctly, allowing a local attacker to exploit a vulnerability to elevate privileges...