305 matches found
Philips Hue - Corrupted files, Dangerous filesystem permissions, Exported components vulnerabilities
HackApp vulnerability scanner discovered that application Philips Hue published at the 'play' market has multiple vulnerabilities...
Cloudera HUE Session cookies stored in the database
User session cookies are stored in the database. Combined with the vulnerability related to configuration file which is world readable, it is possible to spoof a user across the entire cluster launching jobs and browsing the datalake, without having to crack password hashes. Cookies are stored in...
Cloudera HUE Configuration file world readable
The hue.ini configuration file is by default accessible to anyone with the other permission set to read: $ ls -al /etc/hue/conf/hue.ini -rw-rw-r-- 1 root root 22813 Nov 18 2015 /etc/hue/conf/hue.ini Several account credentials can be found in that configuration file such as: Database account: thi...
Cloudera HUE =< 3.9.0 is vulnerable to multiple stored XSS (CVE-2016-4946)
Cloudera HUE = 3.9.0 is vulnerable to multiple stored XSS: In the Username, First name and Last name fields of a user profile. This can be triggered while logging in with the account. In the Group Name field of group creation. This can be triggered when sharing an item...
Cloudera HUE =< 3.9.0 Enumerating users with an unprivileged account (CVE-2016-4947)
Cloudera HUE =/desktop/api/users/autocomplete Open redirection Cloudera HUE =:8888/accounts/login/?next=//google.fr...
Cross site request forgery (csrf)
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...
CVE-2016-4946
Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...
CVE-2016-4947
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...
CVE-2016-4946
Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...
CVE-2016-4947
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...
CVE-2016-4946
CVE-2016-4946 affects Cloudera Hue up to version 3.9.0, with multiple stored XSS in the HUE Users page (First name/Last name) and in group-name handling. The issue arises from unsanitized input fields allowing injection of script/HTML; exploitation is possible remotely and may require user intera...
CVE-2016-4947
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...
CVE-2016-4947
CVE-2016-4947 affects Cloudera HUE 3.9.0 and earlier, where a remote attacker can enumerate user accounts by sending a request to desktop/api/users/autocomplete. The impact is user enumeration via a publicly accessible endpoint; no exploit details are provided beyond the endpoint, and the connect...
CVE-2016-4946
Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...
PT-2017-8626
Name of the Vulnerable Software and Affected Versions Cloudera HUE versions 3.9.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the First name or Last name field in the HUE Users page, potentially leading to cross-site scripting XSS attacks...
CVE-2016-4947: Exposure of Sensitive Information to an Unauthorized Actor
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...
CVE-2016-4946: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name or 2 Last name field in the HUE Users page...
PT-2017-8627
Name of the Vulnerable Software and Affected Versions Cloudera HUE versions 3.9.0 and earlier Description The issue allows remote attackers to enumerate user accounts via a request to "desktop/api/users/autocomplete". This enables attackers to gather information about existing user accounts...
