CVE-2022-46415

The DJI Spark vulnerability CVE-2022-46415 affects the DJI Spark firmware 01.00.0900. A remote attacker can exploit a DHCP implementation flaw after connecting to the device’s internal Wi‑Fi, exhausting the DHCP IP address pool by sending a high volume of DHCP requests, leading to denial of servi...

CVE-2022-46415

DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network e.g., by guessing the password. Then, the attacker would need to send...

DJI Spark 安全漏洞

DJI Spark is a drone product from China's DJI that consists of a flying machine, a remote control, a gimbal camera, and a companion DJI GO App. A security vulnerability exists in DJI Spark version 01.00.0900. A remote attacker could exploit this vulnerability to prevent legitimate endpoint...

Apache Spark <= 3.0.3 / 3.1.x > 3.1.1 / 3.2.x < 3.2.1 RCE (CVE-2022-33891)

A remote code execution vulnerability exists in Apache Spark. The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are...

CVE-2022-46415

DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network e.g., by guessing the password. Then, the attacker would need to send...

GHSA-Q6G2-G7F3-RR83 vulnerabilities

Vulnerabilities for packages: druid...

GHSA-Q6G2-G7F3-RR83 vulnerabilities

Vulnerabilities for packages: druid...

CVE-2023-1436 vulnerabilities

Vulnerabilities for packages: druid...

CVE-2023-1436 vulnerabilities

Vulnerabilities for packages: druid...

Apache Spark < 2.4.6 RCE (CVE-2020-9480)

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

Apache Spark <= 3.0.3 / 3.1.1 < 3.1.3 / 3.2.x < 3.2.1 RCE (CVE-2022-33891)

Binary data apachesparkcve-2022-33891.nbin...

Apache Spark Detection

Binary data apachesparkdetect.nbin...

CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added three security flaws to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The list of vulnerabilities is below - CVE-2022-35914 CVSS score: 9.8 - Teclib GLPI Remote Code Execution...

CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added three security flaws to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The list of vulnerabilities is below - CVE-2022-35914 CVSS score: 9.8 - Teclib GLPI Remote Code Execution...

Apache Spark Command Injection Vulnerability

Apache Spark contains a command injection vulnerability via Spark User Interface UI when Access Control Lists ACLs are enabled...

CVE-2022-33891

A flaw was found in Apache Spark. This flaw allows a malicious user to impersonate another user and jeopardize the environment by executing shell commands...

K33828251: Apache Spark vulnerability CVE-2022-33891

Security Advisory Description The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1 <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1 <=0.25-rc3) +3092 more potentially affected by CVE-2014-125087 via com.jamesmurty.utils:java-xmlbuilder (>=0.3 <=1.1)

com.jamesmurty.utils:java-xmlbuilder MAVEN version =0.3, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =0.42.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.3 and more Source cves: CVE-2014-125087 Source advisory: OSV:GHSA-3VRC-RRPW-R5PW...

SUSE CVE-2018-1334

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application...

SUSE CVE-2018-8024

In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the...