Cloudera HUE =< 3.9.0 is vulnerable to multiple stored XSS (CVE-2016-4946)

Cloudera HUE = 3.9.0 is vulnerable to multiple stored XSS: In the Username, First name and Last name fields of a user profile. This can be triggered while logging in with the account. In the Group Name field of group creation. This can be triggered when sharing an item...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...

CVE-2016-4946

Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...

CVE-2016-4947

Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...

CVE-2016-4946

Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...

Cross site request forgery (csrf)

Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...

CVE-2016-4947

Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...

CVE-2016-4946

Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...

CVE-2016-4947

CVE-2016-4947 affects Cloudera HUE 3.9.0 and earlier, where a remote attacker can enumerate user accounts by sending a request to desktop/api/users/autocomplete. The impact is user enumeration via a publicly accessible endpoint; no exploit details are provided beyond the endpoint, and the connect...

CVE-2016-4947

Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...

CVE-2016-4946

CVE-2016-4946 affects Cloudera Hue up to version 3.9.0, with multiple stored XSS in the HUE Users page (First name/Last name) and in group-name handling. The issue arises from unsanitized input fields allowing injection of script/HTML; exploitation is possible remotely and may require user intera...

Cloudera HUE HTML Injection Vulnerability

Cloudera Hue is an open source Apache Hadoop UI system from the U.S. company Cloudera. Cloudera HUE suffers from an HTML injection vulnerability. An attacker can exploit the vulnerability to steal cookie-based authentication and execute arbitrary HTML or script code...

Cloudera HUE User Enumeration Vulnerability

Cloudera Hue is an open source Apache Hadoop UI system from the U.S. company Cloudera. A user enumeration vulnerability exists in Cloudera HUE. A remote attacker can exploit the vulnerability to gain access to the enumerated database users...

Talk to HUE Trial - Customized SSL, Dangerous filesystem permissions, Insecure KeyStore vulnerabilities

HackApp vulnerability scanner discovered that application Talk to HUE Trial published at the 'play' market has multiple vulnerabilities...

Hue /usr/lib/hue/build/env/bin/supervisor insecure privilege setting vulnerability

Hue is an open source Apache Hadoop UI system. Hue /usr/lib/hue/build/env/bin/supervisor fails to set permissions correctly, allowing a local attacker to exploit a vulnerability to elevate privileges...

Philips Light Bulb Vulnerability Could Leave Some In the Dark

According to research unveiled this week some types of web-enabled light bulbs are vulnerable to a flaw wherein an attacker could literally leave users of the bulbs in the dark. Philips’ Hue brand lighting systems can be exploited, according to independent researcher Nitesh Dhanjani who published...