CVE-2018-0436

CVE-2018-0436 concerns Cisco Webex Teams (formerly Cisco Spark). The issue arises from insufficient checks for associations between user accounts and organization accounts, enabling an authenticated, remote attacker with administrator or compliance officer privileges for one organization to view ...

CVE-2018-0436 Cisco Webex Teams Information Disclosure and Modification Vulnerability

A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between use...

Spark allows remote attackers to read arbitrary files via a .. (dot dot) in the URI

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

ai.grakn:grakn-bootup (>=1.1.0 <=v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744), ai.grakn:grakn-dist (>=0.7.0 <=v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744) +98 more potentially affected by CVE-2016-9177 via com.sparkjava:spark-core (>=1.0 <=2.5.1)

com.sparkjava:spark-core MAVEN version =1.0, =1.1.0, =0.7.0, =0.6.1, =0.6.1, =0.7.0, =0.15.0, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.16.0, =1.0, =1.2.0 - br.com.logiquesistemas:easy-spark =1.0.0 and more Source cves: CVE-2016-9177 Source advisory: OSV:GHSA-89GC-6CW6-4VCH...

GHSA-89GC-6CW6-4VCH Spark allows remote attackers to read arbitrary files via a .. (dot dot) in the URI

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2018-1330 vulnerabilities

Vulnerabilities for packages: spark...

Apache Spark < 2.1.3 / 2.2.x < 2.2.2 / 2.3.x < 2.3.1 XSS in UI

The remote web server is running a version of Apache Spark that is affected by a Cross-Site Scripting XSS vulnerability due to a flaw in Spark cluster's UI's job and stage info pages, which allows a remote attacker to use specially crafted requests that can lead to arbitrary HTML and script code...

SUSE-SU-2018:2689-1 Security update for spark

This update for spark fixes the following security issue: - CVE-2018-9159: Fix a security problem in the serving of static files. bsc1087837...

Apache Spark Authentication Control Vulnerability

Apache Spark is a large-scale data processing engine that supports acyclic data streams and in-memory computing from the Apache Software Foundation. A security vulnerability exists in Apache Spark versions 1.3.0 and later, which is caused by a standalone master or a Mesos master with cluster mode...

Critical: Red Hat Security Advisory: Red Hat FIS 2.0 on Fuse 6.3.0 R7 security and bug fix update

An update is now available for Red Hat Fuse Integration Services. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

spark: Absolute and relative pathnames allow for unintended static file disclosure

In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark...

Exposed API

Apache's spark contains an exposed API due to the default value of spark.master.rest.enabled being set to true. This allows remote attackers to connect to the API without authentication and run driver programs but not launch executors...

CVE-2018-11770

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

CVE-2018-11770

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

CVE-2018-11770

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

Authentication flaw

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

CVE-2018-11770

CVE-2018-11770 affects Apache Spark 1.3.0+ where the standalone master exposes a REST API for job submission that bypasses the configured spark.authenticate.secret. The REST API does not require authentication and, per multiple sources, could allow a user to run a driver program without authentic...

CVE-2018-11770

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

Apache Spark Unauthenticated Command Execution

This module exploits an unauthenticated command execution vulnerability in Apache Spark with standalone cluster mode through REST API. It uses the function CreateSubmissionRequest to submit a malious java class and trigger it. This module requires Metasploit: https://metasploit.com/download Curre...

The first Spark REST API is not authorized to exploit analysis-exploit warning-the black bar safety net

2018 7 on 7 May, Ali Cloud Security for the first time to capture the Spark REST API unauthorized RCE vulnerability to attack of real samples. 7 on number 9 plays, Ali Cloud Platform has been able to the default of Defense the vulnerability of the large-scale use. This is the first time in...