303 matches found
Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies
Apache Ranger before 0.6.is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies...
Moderate severity vulnerability that affects org.apache.ranger:ranger
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...
GHSA-VHXC-8JJQ-859J Moderate severity vulnerability that affects org.apache.ranger:ranger
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...
GHSA-RF7Q-XQM3-6923 Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML
Cross-site scripting XSS vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies...
Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML
Cross-site scripting XSS vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies...
GHSA-4RJF-MXFM-98H5 SQL injection vulnerability in the policy admin tool in Apache Ranger
SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime...
SQL injection vulnerability in the policy admin tool in Apache Ranger
SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime...
GHSA-J84C-J8QM-G47R The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...
Apache Ranger UnixAuthenticationService Buffer Overflow Vulnerability
Apache Ranger provides a centralized security management framework and addresses authorization and auditing. Apache Ranger UnixAuthenticationService handles user input with a buffer overflow vulnerability that can be exploited by a remote attacker to submit a special request and trick the user in...
CVE-2018-11778
UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 should be upgraded to 1.2.0...
Stack overflow
UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 should be upgraded to 1.2.0...
CVE-2018-11778
UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 should be upgraded to 1.2.0...
CVE-2018-11778
UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 should be upgraded to 1.2.0...
CVE-2018-11778
CVE-2018-11778 affects UnixAuthenticationService in Apache Ranger. Multiple connected sources confirm that UnixAuthenticationService handles user input and previously vulnerable versions could be susceptible to a stack-based buffer overflow, potentially allowing crash or arbitrary code execution....
Apache Ranger Security Bypass Vulnerability
Apache Ranger is the Apache Software Foundation's architecture for implementing comprehensive security measures for Hadoop clusters, which provides centralized security policy management for core enterprise security requirements such as authorization, billing, and data protection.Hive Authorizer ...
Apache Ranger Security Bypass Vulnerability (CNVD-2018-03764)
Apache Ranger is the Apache Software Foundation's architecture for implementing comprehensive security measures for Hadoop clusters, which provides centralized security policy management for core enterprise security requirements such as authorization, billing, and data protection. policy resource...
Code injection
Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...
CVE-2017-12625
Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...