GHSA-RCJC-C4PJ-XXRP vulnerabilities

Vulnerabilities for packages: logstash-integration-jdbc, spark, druid...

CVE-2022-46337 vulnerabilities

Vulnerabilities for packages: logstash-integration-jdbc, spark, druid...

CVE-2022-46337 vulnerabilities

Vulnerabilities for packages: hadoop-fips, spark-fips, druid, logstash-integration-jdbc, spark...

com.databricks.labs:automl-toolkit (=0.8.1), ml.combust.mleap:mleap-avro_2.12 (>=0.14.0 <=0.23.0) +14 more potentially affected by CVE-2023-5245 via ml.combust.mleap:mleap-runtime_2.12 (>=0.14.0 <=0.23.0)

ml.combust.mleap:mleap-runtime2.12 MAVEN version =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.19.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.19.0, =0.14.0, =0.17.0, =0.23.0 and more Source cves: CVE-2023-5245 Source advisory: OSV:GHSA-897X-XVJ8-42RQ...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: ip-masq-agent, aws-ebs-csi-driver, aws-efs-csi-driver-fips, nodetaint, spark-operator, kubernetes-dns-node-cache, aws-efs-csi-driver, prometheus-adapter...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, nodetaint, ip-masq-agent, prometheus-adapter, spark-operator, kubernetes-dns-node-cache...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, nodetaint, ip-masq-agent, prometheus-adapter, spark-operator, kubernetes-dns-node-cache...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, aws-ebs-csi-driver, aws-efs-csi-driver-fips, nodetaint, spark-operator, kubernetes-dns-node-cache, aws-efs-csi-driver, prometheus-adapter...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubevela, kube-oidc-proxy, kubescape, falcoctl-fips, spark-operator, dynamic-localpv-provisioner-fips, dgraph, cortex, src, up, scorecard, bank-vaults-fips, k3d, metrics-server-fips, kubernetes-csi-livenessprobe, conftest-fips, smarter-device-manager-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: buildkitd, terraform-provider-sendgrid, up, cortex, kubeflow, k3d, kubescape, kubevela, dgraph, prometheus-blackbox-exporter, slsa-verifier, scorecard, aactl, src, spark-operator...

Oracle Business Intelligence Enterprise Edition (OAS 6.4) (October 2023 CPU)

The version of Oracle Business Intelligence Enterprise Edition OAS 6.4.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory, including the following: - Vulnerability in the Oracle Business Intelligence Enterprise Edition product...

PT-2023-9835 · Apache · Apache Spark +1

Name of the Vulnerable Software and Affected Versions: Apache Hive versions 1.2.0 and later Apache Spark versions 2.0.0 and later Description: The issue is related to the exposure of digital signatures in cookie data, which can lead to security vulnerabilities and exploitation. The vulnerable...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: flux-image-reflector-controller, kubernetes-ingress-defaultbackend, dynamic-localpv-provisioner-fips, kpt, flux-helm-controller, weaviate, dgraph, bom, vault-k8s, k3d, prometheus-statsd-exporter, metrics-server-fips, aws-efs-csi-driver, runc, tkn,...

Security Bulletin: IBM Operations Analytics Predictive Insights v1.3.6 ifix7 contains fixes for multiple security vulnerabilities.

Summary IBM Operations Analytics Predictive Insights v1.3.6 ifix7 contains fixes for multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2023-32007 DESCRIPTION: Apache Spark could allow a remote authenticated attacker to execute arbitrary commands on the...

ae.teletronics.nlp:entityextraction (=1.3), ai.catboost:catboost-spark_2.11 (>=0.25-rc1 <=0.25-rc3) +13957 more potentially affected by CVE-2023-44981 via org.apache.zookeeper:zookeeper (>=3.3.0 <=3.7.1)

org.apache.zookeeper:zookeeper MAVEN version =3.3.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.10 and more Source cves: CVE-2023-44981 Source advisory: OSV:GHSA-7286-PGFV-VXVH...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, git-lfs, pulumi-language-java, kubewatch, kubevela, stakater-reloader, flux-source-controller, nghttp2, aws-efs-csi-driver, oauth2-proxy, dex, wireguard-go, metacontroller, gomplate, terraform-provider-aws, atlantis, aactl, conftest, src,...

Apache Spark < 3.4.0 Privilege Escalation (CVE-2023-22946)

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This...

Apache Spark < 3.2.2 / 3.3.0 < 3.3.1 XSS (CVE-2022-31777)

The version of Apache Spark installed on the remote host is prior to 3.2.2 or is 3.3.0. It is, therefore, affected by a cross-site scripting XSS vulnerability. An authenticated, remote attacker can execute arbitrary JavaScript in the web browser of a user by including a malicious payload into the...

ai.catboost:catboost-spark_2.3_2.11 (>=1.2.1 <=1.2.7), ai.catboost:catboost-spark_2.4_2.11 (>=1.2.1 <=1.2.7) +6314 more potentially affected by CVE-2023-43642 via org.xerial.snappy:snappy-java (>=1.0.1-rc3 <=1.1.10.3)

org.xerial.snappy:snappy-java MAVEN version =1.0.1-rc3, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.3, =1.2.3, =0.13.0, =0.14.0 and more Source cves: CVE-2023-43642 Source advisory: OSV:GHSA-55G7-9CWV-5QFV...

Security Bulletin: Due to use of Spark from Hadoop, IBM Cloud Pak for Multicloud Management Monitoring could allow a remote attacker to traverse directories on the system.

Summary Vulnerability in Spark from Hadoop affect IBM Cloud Pak for Multicloud Management Monitoring. Vulnerability Details CVEID:CVE-2018-8009 DESCRIPTION: Apache Hadoop could could allow a remote attacker to traverse directories on the system. By persuading a victim to extract a specially-craft...