Input validation

In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient...

CVE-2017-7665

In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient...

CVE-2017-7665

CVE-2017-7665 : In Apache NiFi, before 0.7.4 and 1.x before 1.3.0, certain UI input components did not sufficiently guard against some forms of XSS. This is a cross-site scripting vulnerability in the NiFi web UI due to insufficient input validation in UI components. Connected advisories (GHSA-M5...

CVE-2017-7665

In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient...

CVE-2017-7667

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin...

CVE-2017-7667

CVE-2017-7667 affects Apache NiFi versions prior to 0.7.4 and 1.x prior to 1.3.0. The issue is an Origin Validation/Framing problem where NiFi did not set a suitable X-Frame-Options header, leaving the application vulnerable to cross-frame framing attacks. Connected advisories (GHSA/JQ99, CNVD/CN...

Cross-site Scripting (XSS)

nifi-web-ui is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary JavaScript due to the library insufficient validation on user input when creating SlickGrid tables...

Cross-site Scripting (XSS)

nifi-jetty is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary JavaScript because the library does have the sufficient response headers to only allow framing from the same origin...

Apache NiFi Security Bypass Vulnerability

Apache NiFi is an automated solution for data transfer between systems. A security bypass vulnerability exists in Apache NiFi. An attacker could use this vulnerability to bypass security restrictions, perform unauthorized operations, and launch further attacks...

Apache NiFi Remote Code Injection Vulnerability

Apache NiFi is an automated solution for data transfer between systems. Apache NiFi suffers from a remote code injection vulnerability. An attacker can exploit this vulnerability to execute arbitrary code in the context of a user running in an affected application, with a failed attack resulting ...

Unauthorized Access Via User Impersonation

Apache nifi is vulnerable to unauthorized access via user impersonation attacks. The vulnerability exists due to a possible injection attack in a cluster environment, in the proxy chain's serialization/deserialization. A malicious user can inject in their username to impersonate another user to...

Unauthorized Data Access In Cluster

Apache nifi is vulnerable to unauthorized data accesses. The vulnerability exists in a cluster environment when an anonymous user request is replicated to another node. The replicated node identity will contain the originating node identity instead of the anonymous user's identity...

Leakage Of Decryption Key

nifi is susceptible to information disclosure. The vulnerability exists because running the encrypt-config.sh script allows the boostrap process RunNiFi.java to leak the sensitive property decryption key in 1 in the plaintext in boostrap.conf 2 in the process invocation...

Apache NiFi Cross-Site Scripting Vulnerability

Apache NiFi is an automated solution for data transfer between systems. Apache NiFi suffers from a cross-site scripting vulnerability in the connection details dialog box, which allows an attacker to inject malicious code into the affected site...

Cross-site Scripting (XSS)

Apache Nifi is vulnerable to cross-site scripting XSS vulnerability in connection details dialog when accessed by an authorized user. It does not properly handle the user supplied text when added to the DOM...

Apache NiFi 1.0.0 / 1.1.0 Cross Site Scripting Vulnerability

Exploit for multiple platform in category web applications CVE-2016-8748: Apache NiFi XSS vulnerability in connection details dialogue Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: Apache NiFi 1.0.0 Apache NiFi 1.1.0 Description: There is a cross-site scripting...