1193 matches found
CVE-2022-31777 Apache Spark XSS vulnerability in log viewer UI Javascript
A stored cross-site scripting XSS vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI...
Security Bulletin: Multiple vulnerabilities in Spark affecting IBM QRadar User Behavior Analytics
Summary Multiple vulnerabilities exist in Spark, which is used by IBM QRadar User Behavior Analytics UBA. These vulnerabilities are addressed in UBA by upgrading to a version of Spark and packages that are associated with Spark that resolve the vulnerabilities. Vulnerability Details...
ae.teletronics.nlp:entityextraction (=1.3), ae.teletronics.nlp:w2vec (=1.0) +20762 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (>=2.0.3 <=3.16.1)
com.google.protobuf:protobuf-java MAVEN version =2.0.3, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2022-3171 Source advisory: OSV:GHSA-H4H5-3HR4-J3G2...
Apache Spark < 3.0.3 / 3.1.1 < 3.1.2 Remote Command Injection
Apache Spark UI versions 3.0.3, 3.1.1 3.1.2 with ACL's on the server instance perform insufficient sanitization of parameters subsequently used in a permissions check, which may allow an attacker to inject arbitrary shell commands with the permissions of the Spark user. No source data...
GHSA-8QV5-68G4-248J vulnerabilities
Vulnerabilities for packages: spark-scala-2.13...
GHSA-8QV5-68G4-248J vulnerabilities
Vulnerabilities for packages: spark-fips...
CVE-2022-36944 vulnerabilities
Vulnerabilities for packages: spark-scala-2.13...
CVE-2022-36944 vulnerabilities
Vulnerabilities for packages: spark-fips...
ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1 <=1.2.8), ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6 <=1.2.10) +7975 more potentially affected by CVE-2022-40152 via com.fasterxml.woodstox:woodstox-core (>=5.0.0 <=5.3.0)
com.fasterxml.woodstox:woodstox-core MAVEN version =5.0.0, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.0.25, =0.0.25, =0.0.62, =0.0.25, =0.0.86, =0.0.8, =threadcontention-0.0.23-dev3 and more Source cves: CVE-2022-40152 Source advisory: OSV:GHSA-3F7H-MF4Q-VRM4...
ae.teletronics.nlp:entityextraction (=1.3), ai.catboost:catboost-spark_2.11 (>=0.25-rc1 <=0.25-rc3) +9241 more potentially affected by CVE-2022-40150 via org.codehaus.jettison:jettison (>=1.0 <=1.5.1)
org.codehaus.jettison:jettison MAVEN version =1.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.10 and more Source cves: CVE-2022-40150 Source advisory: OSV:GHSA-X27M-9W8J-5VCW...
ae.teletronics.nlp:entityextraction (=1.3), ai.catboost:catboost-spark_2.11 (>=0.25-rc1 <=0.25-rc3) +9206 more potentially affected by CVE-2022-40149 via org.codehaus.jettison:jettison (>=1.0 <=1.5.0)
org.codehaus.jettison:jettison MAVEN version =1.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.10 and more Source cves: CVE-2022-40149 Source advisory: OSV:GHSA-56H3-78GP-V83R...
Metasploit Weekly Wrap-Up
Authenticated command injection vulnerability of Cisco ASA-X with FirePOWER Services: jbaines-r7 added a new module that exploits an authenticated command injection vulnerability CVE-2022-20828 of Cisco ASA-X with FirePOWER Services. This vulnerability affects all Cisco ASA appliances that suppor...
Apache Spark Unauthenticated Command Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/stopwatch' class MetasploitModule 'Apache Spark Unauthenticated Command Injection RCE', 'Description' = %q This module exploits an unauthenticated command...
Apache Spark Unauthenticated Command Injection Exploit
This Metasploit module exploits an unauthenticated command injection vulnerability in Apache Spark. Successful exploitation results in remote code execution under the context of the Spark application user. The command injection occurs because Spark checks the group membership of the user passed i...
Apache Spark Unauthenticated Command Injection RCE
This module exploits an unauthenticated command injection vulnerability in Apache Spark. Successful exploitation results in remote code execution under the context of the Spark application user. The command injection occurs because Spark checks the group membership of the user passed in the ?doAs...
Remote Code Execution (RCE)
Apache Spark 'master' host is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of user request to the authentication-disabled 'master' host allowing an attacker to execute code via a maliciously crafted request...
Arbitrary File Write
spark-core is vulnerable to arbitrary file write. Lack of explicit checking of existence of source file in Utils.unpack before calling the method FileUtil.unTar of Hadoop which has a loophole in handling of missing .tar files...
Vulnerability Fixed in Azure Synapse Spark
Summary Summary Microsoft takes a proactive approach to continually probe our defenses, hunt for vulnerabilities, and seek new, innovative ways to protect our customers. Security researchers are an important part of this effort, and our collaborative partnership is critical in a world where...
Vulnerability Fixed in Azure Synapse Spark
Summary Microsoft takes a proactive approach to continually probe our defenses, hunt for vulnerabilities, and seek new, innovative ways to protect our customers. Security researchers are an important part of this effort, and our collaborative partnership is critical in a world where cybersecurity...