CVE-2023-34212

CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi The JndiJmsConnectionFactoryProvider Controller Service along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properti...

asf__nifi_CVE-2023-34468_1-21-00

Apache NiFi es un sistema fácil de usar, potente y confiable para procesar y distribuir datos. Tabla de contenidos Características Requisitos Primeros pasos Subproyecto MiNiFi Subproyecto Registry Ayuda...

CVE-2023-34468

CVE-2023-34468 — PoC de RCE mediante H2 RUNSCRIPT en ExecuteSQL de Apache NiFi PoC corto en Python para abusar de un procesador ExecuteSQL editable de Apache NiFi con una carga útil RUNSCRIPT de H2 para desencadenar la ejecución remota de comandos a través de una reverse shell de Bash. Solo para...

Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

asf__nifi_CVE-2023-36542_1-22-0

Apache NiFi Estado Recursos Contactos !Track Issueshttps://img...

CVE-2023-40037

CVE-2023-40037: Incomplete Validation of JDBC and JNDI Connection URLs in Apache NiFi Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs...

apache__nifi_CVE-2022-33140_1-16-22

Apache NiFi Estado Recursos Contactos !Track Issueshttps://img...

CVE-2023-34468

CVE-2023-34468: Remote Code Execution via DB Components in Apache NiFi The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code...

CVE-2023-34468

CVE-2023-34468 Exploit Overview This repository provides a Python-based exploit tool for CVE-2023-34468 , a critical remote code execution vulnerability CVSS 9.8 in Apache NiFi versions 0.0.2 through 1.21.0. It allows authenticated users to execute arbitrary code by manipulating H2 database...

CVE-2023-34468-PoC

CVE-2023-34468 PoC para Apache NiFi Prueba de concepto PoC educativa para CVE-2023-34468 que afecta a Apache NiFi versiones anteriores a 1.22.0. Este repositorio demuestra cómo el abuso de la configuración de URL JDBC de H2 puede conducir a la ejecución remota de código RCE autenticada en...

My-Exploits

My-Exploits Investigación de vulnerabilidades que he realizado en cuatro servicios de plataforma ampliamente desplegados: Keycloak, Apache NiFi, HashiCorp Vault y HashiCorp Nomad. Para cada hallazgo, este repositorio contiene los artefactos de escritura única que realmente utilizo, un módulo de...

CVE-2023-34468-POC

CVE-2023-34468 — Apache NiFi 1.21.0 RCE PoC Ejecución remota de código mediante RUNSCRIPT de la base de datos H2 en Apache NiFi = 1.21.0 Vulnerabilidad Apache NiFi incluye un JAR de la base de datos H2 de forma predeterminada. El servicio controlador DBCPConnectionPool puede configurarse para usa...

CVE-2024-56512-Apache-NiFi-Exploit

NiFiExploit Uno strumento per sfruttare la vulnerabilità CVE-2024-56512 in Apache NiFi , che consente l'accesso non autorizzato a dati sensibili tramite API non adeguatamente protette...

nifi-CVE-2026-39816-poc

Apache NiFi CVE-2026-39816 POC Dimostrazione proof-of-concept per CVE-2026-39816, un bypass del permesso EXECUTECODE in Apache NiFi 2.8.0 che consente a un progettista di flussi a cui sono stati deliberatamente negati i privilegi di esecuzione del codice di eseguire Groovy arbitrario nella JVM di...

GHSA-GGG2-9786-HWC8 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe...

CVE-2026-73508 vulnerabilities

Vulnerabilities for packages: apache-nifi, druid, celeborn, spark, zipkin, thingsboard, apache-pulsar, akhq, management-api-for-apache-cassandra-5.0, keycloak, tez, opensearch, strimzi-kafka-operator, apicurio-registry...

CVE-2026-41706 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, geoserver...

GHSA-X2R2-RVHQ-2MQV vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, geoserver...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68979

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...