CVE-2022-34808

Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

PT-2022-6642 · Cisco +1 · Jenkins Cisco Spark Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Cisco Spark Plugin versions 1.1.1 and earlier Description: The issue is related to the storage of bearer tokens in an unencrypted form in the global configuration file org.jenkinsci.plugins.spark.SparkNotifier.xml on the Jenkins...

Jenkins Plugin Cisco Spark 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...

GHSA-M43H-HFRQ-X8WX SystemDS CPU exhaustion vulnerability

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

SystemDS CPU exhaustion vulnerability

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

Malicious Package

Overview spark-overlay is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

MAL-2022-6229 Malicious code in spark-pr-board (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 120c6f6b14abe7ae9c2ac0f2e14844f9f2cd26b7cf7b33a677e013d0f6db4891 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spark-pr-board (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 120c6f6b14abe7ae9c2ac0f2e14844f9f2cd26b7cf7b33a677e013d0f6db4891 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in synapse-spark (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ab3451077741f002a7a21911063336175057ffc6c22ace4dd4d0e25026162e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6387 Malicious code in synapse-spark (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ab3451077741f002a7a21911063336175057ffc6c22ace4dd4d0e25026162e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1 <=1.2.8), ai.chronon:aggregator_2.12 (>=0.0.25 <=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91) +1301 more potentially affected by CVE-2021-37404 via org.apache.hadoop:hadoop-common (>=3.0.0 <=3.2.2)

org.apache.hadoop:hadoop-common MAVEN version =3.0.0, =1.0.1, =0.0.25, =0.0.25, =0.0.62, =0.0.25, =0.0.86, =thread-pool-0.0.24-dev, =0.0.6, =0.0.2, =3.34.0.3-1-3.1, =0.0.3, =1.0.0, =1.4.0, =1.5.0 and more Source cves: CVE-2021-37404 Source advisory: OSV:GHSA-RMPJ-7C96-MRG8...

ae.teletronics.nlp:entityextraction (=1.3), ae.teletronics.nlp:w2vec (=1.0) +15912 more potentially affected by CVE-2019-10202 via org.codehaus.jackson:jackson-mapper-asl (>=0.9.8 <=1.9.13)

org.codehaus.jackson:jackson-mapper-asl MAVEN version =0.9.8, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2019-10202 Source advisory: OSV:GHSA-C27H-MCMW-48HV...

GHSA-C27H-MCMW-48HV vulnerabilities

Vulnerabilities for packages: hadoop-fips...

GHSA-C27H-MCMW-48HV vulnerabilities

Vulnerabilities for packages: tez...

ae.teletronics.nlp:entityextraction (=1.3), ae.teletronics.nlp:w2vec (=1.0) +640 more potentially affected by CVE-2018-11804 via org.apache.spark:spark-core_2.11 (>=1.3.0 <=2.1.3)

org.apache.spark:spark-core2.11 MAVEN version =1.3.0, =2.0.0, =2.0.0, =2.0.0, =2.0.18, =2.0.0, =1.0.0, =0.5.2, =1.0, =2.11-2.1.1-2.2.0, =4.2.0, =5.1.0, =5.1.2 and more Source cves: CVE-2018-11804 Source advisory: OSV:GHSA-62G2-M955-V383...

ai.grakn:client-java (=1.3.0), ai.grakn:grakn-bootup (>=1.1.0 <=v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744) +565 more potentially affected by CVE-2018-11804 via org.apache.spark:spark-core_2.10 (>=1.3.0 <=2.1.3)

org.apache.spark:spark-core2.10 MAVEN version =1.3.0, =1.1.0, =0.7.0, =0.12.0, =1.2.0, =0.12.0, =1.0.0, =1.0.0, =0.10.0, =0.15.0, =0.6.1, =0.17.0, =1.1.0 and more Source cves: CVE-2018-11804 Source advisory: OSV:GHSA-62G2-M955-V383https://vulners.com/osv/OSV:GHSA-62G2-M955-V3...

GHSA-62G2-M955-V383 Improper Input Validation in Apache Spark

Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A...

Improper Input Validation in Apache Spark

Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A...

GHSA-95Q3-PPPP-R683 vulnerabilities

Vulnerabilities for packages: spark...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1 <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1 <=0.25-rc3) +5724 more potentially affected by CVE-2016-5725 via com.jcraft:jsch (>=0.1.23 <=0.1.53)

com.jcraft:jsch MAVEN version =0.1.23, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =3.20.0.2, =3.20.0.2, =3.8.3.3, =2.0.18, =2.0.18, =2.0.18, =2.0.18, =1.0.0.9, =0.0.9, =0.1.10 and more Source cves: CVE-2016-5725 Source advisory: OSV:GHSA-Q446-82VQ-W674...