Security Bypass

Apache Ranger is vulnerable to a security bypass vulnerability. This is because the ranger policy engine incorrectly matches paths in certain conditions when a policy does not contain wildcards and has recursion flag set to true...

Apache Ranger Security Bypass Vulnerability (CNVD-2017-01460)

Apache Ranger is a set of architectures for implementing comprehensive security measures for Hadoop clusters, providing centralized security policy management for core enterprise security requirements such as authorization, billing and data protection. A security bypass vulnerability exists in...

Apache Ranger Detection (HTTP)

HTTP based detection of Apache Ranger. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.809483";...

Apache Ranger Local Elevation of Privilege Vulnerability

Apache Ranger is a set of architectures for implementing comprehensive security measures for Hadoop clusters, providing centralized security policy management for core enterprise security requirements such as authorization, billing and data protection. Apache Ranger suffers from a local elevation...

CVE-2016-5395

Cross-site scripting XSS vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies...

CVE-2016-5395

Cross-site scripting XSS vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies...

Cross site scripting

Cross-site scripting XSS vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies...

CVE-2016-5395

Cross-site scripting XSS vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies...

CVE-2016-5395

CVE-2016-5395 is a cross-site scripting (XSS) vulnerability in Apache Ranger’s policy admin create-user function, exploitable by remote authenticated administrators to inject script or HTML via policy-related vectors. Affected product: Apache Ranger (prior to 0.6.1). Root cause: insufficient inpu...

CVE-2016-5395

Cross-site scripting XSS vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies...

CVE-2016-5395: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies...

PT-2016-6407

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 0.6.1 Description A cross-site scripting XSS issue exists in the create user functionality of the policy admin tool. This allows remote authenticated administrators to inject arbitrary web script or HTML. The...

Apache Ranger HTML Injection Vulnerability

Apache Ranger is the Apache Software Foundation's architecture for implementing comprehensive security measures for Hadoop clusters, providing centralized security policy management for core enterprise security requirements such as authorization, billing, and data protection. Apache Ranger has an...

SOL43254923 - Apache Ranger vulnerability CVE-2016-2174

Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...

CVE-2016-2174

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime...

CVE-2016-2174

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime...

Sql injection

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime...

CVE-2016-2174

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime...

CVE-2016-2174

CVE-2016-2174 describes a SQL injection in the policy admin tool of Apache Ranger prior to 0.5.3. The vulnerability arises from an eventTime parameter being used in a dynamic SQL query (e.g., in service/plugins/policies/eventTime) without proper parameterization, allowing remote authenticated adm...

CVE-2016-2174

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime...