EUVD-2022-5496

Malicious code in bioql PyPI...

EUVD-2023-45697

Malicious code in bioql PyPI...

EUVD-2022-0688

Malicious code in bioql PyPI...

EUVD-2022-4425

Malicious code in bioql PyPI...

EUVD-2022-4438

Malicious code in bioql PyPI...

EUVD-2022-4496

Malicious code in bioql PyPI...

GHSA-8V5Q-RHF3-JPHM vulnerabilities

Vulnerabilities for packages: apache-nifi, thingsboard, apache-nifi-registry, jenkins...

CVE-2025-41248 vulnerabilities

Vulnerabilities for packages: apache-nifi, thingsboard, apache-nifi-registry, jenkins...

CVE-2025-41249 vulnerabilities

Vulnerabilities for packages: apache-nifi, thingsboard, apache-nifi-registry, zipkin, jenkins, keycloak-config-cli...

GHSA-JMP9-X22R-554X vulnerabilities

Vulnerabilities for packages: apache-nifi, thingsboard, apache-nifi-registry, zipkin, jenkins, keycloak-config-cli...

GHSA-8V5Q-RHF3-JPHM vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, jenkins, nacos, nacos-docker, apache-nifi, thingsboard...

CVE-2025-41249 vulnerabilities

Vulnerabilities for packages: conductor-fips, camunda-zeebe, apache-nifi-registry, keycloak-config-cli, apache-activemq-fips, jenkins, nacos, nacos-docker, zipkin, apache-activemq, apache-hop-fips, apache-nifi, thingsboard, conductor, apache-hop...

GHSA-JMP9-X22R-554X vulnerabilities

Vulnerabilities for packages: conductor-fips, camunda-zeebe, apache-nifi-registry, keycloak-config-cli, apache-activemq-fips, jenkins, nacos, nacos-docker, zipkin, apache-activemq, apache-hop-fips, apache-nifi, thingsboard, conductor, apache-hop...

CVE-2025-41248 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, jenkins, nacos, nacos-docker, apache-nifi, thingsboard...

BIT-NIFI-2024-56512 Apache NiFi: Missing Complete Authorization for Parameter and Service References

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

BIT-NIFI-2023-49145 Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, the...

BIT-NIFI-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission fo...

BIT-NIFI-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

BIT-NIFI-2022-29265 Improper Restriction of XML External Entity References in Multiple Components

Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML...

BIT-NIFI-2022-26850 Insufficiently protected credentials

When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the...