GHSA-PQHQ-XX62-2V2P Cross-site scripting in Apache NiFi

A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers...

Cross-site scripting in Apache NiFi

A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers...

GHSA-RQ96-QHC5-VM4R Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...

Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...

Apache NiFi code issue vulnerability (CNVD-2021-102797)

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. A code issue vulnerability exists in Apache NiFi's TransformXML, which stems from a vulnerability in Apache NiFi's...

XML External Entity (XXE) Injection

nifi is vulnerable XML external entity injection attacks. An attacker can configure the XSLT file by including malicious external entity calls, leading to access to sensitive information...

CVE-2021-44145

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...

CVE-2021-44145

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...

Xxe

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...

CVE-2021-44145

CVE-2021-44145 affects the Apache NiFi TransformXML processor (before 1.15.1). An authenticated user could configure an XSLT file that contains external entity calls, potentially revealing sensitive information due to an XXE. The issue is documented across multiple sources, with remediation advis...

CVE-2021-44145 Apache NiFi information disclosure by XXE

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...

Apache NiFi OS Command Injection Vulnerability

Apache NiFi is a data processing and distribution system from the Apache Foundation in the United States. The system is primarily used for data routing, transformation, and system mediation logic. versions prior to Apache NiFi MiNiFi C version 0.5.0 have security vulnerabilities that allow an...

GHSA-3J6G-HXX5-3Q26 vulnerabilities

Vulnerabilities for packages: apache-nifi...

GHSA-3J6G-HXX5-3Q26 vulnerabilities

Vulnerabilities for packages: hive...

CVE-2021-38153 vulnerabilities

Vulnerabilities for packages: apache-nifi...

CVE-2021-38153 vulnerabilities

Vulnerabilities for packages: hive...

CVE-2021-33191

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

CVE-2021-33191

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

Command injection

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

CVE-2021-33191 MiNiFi CPP arbitrary script execution is possible on the agent's host machine through the c2 protocol

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...