1395 matches found
CVE-2021-38294
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...
CVE-2021-38294
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...
CVE-2021-38294
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...
Command injection
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...
CVE-2021-40865
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution RCE. Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x...
Deserialization of untrusted data
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution RCE. Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x...
CVE-2021-40865 Unsafe Pre-Authentication Deserialization In Workers
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution RCE. Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x...
CVE-2021-40865
CVE-2021-40865 affects Apache Storm: Unsafe Deserialization in the worker services of the Storm supervisor server enables pre-auth remote code execution. Vulnerable lines include Storm 2.2.x (upgrade to 2.2.1 or 2.3.0), 2.1.x (upgrade to 2.1.1), and 1.x (upgrade to 1.2.4). Other connected advisor...
CVE-2021-38294
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...
CVE-2021-38294 Shell Command Injection Vulnerability in Nimbus Thrift Server
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...
CVE-2021-38294
CVE-2021-38294 affects Apache Storm 2.x (<2.2.1) and 1.x (
Apache Storm 操作系统命令注入漏洞
Apache Storm is a free and open source distributed real-time computing system. A command injection vulnerability exists in Apache Storm's getTopologyHistory service. An attacker can exploit this vulnerability by sending a specially crafted thrift request to the Nimbus server to achieve remote cod...
Apache Storm Nimbus getTopologyHistory Unauthenticated Command Execution
This module exploits an unauthenticated command injection vulnerability within the Nimbus service component of Apache Storm. The getTopologyHistory RPC method method takes a single argument which is the name of a user which is concatenated into a string that is executed by bash. In order for the...
Apache Storm 代码问题漏洞
Apache Storm is a free and open source distributed real-time computing system. Apache Storm code issue vulnerability. An attacker could exploit the vulnerability to achieve remote code execution...
CVE-2021-38294: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...
CVE-2021-40865: Deserialization of Untrusted Data
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution RCE. Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x...
PT-2021-5490
Name of the Vulnerable Software and Affected Versions Apache Storm versions 2.2.x prior to 2.2.1 Apache Storm versions 2.1.x prior to 2.1.1 Apache Storm versions 1.x prior to 1.2.4 Description An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor...
PT-2021-5193 · Apache · Apache Storm
Name of the Vulnerable Software and Affected Versions: Apache Storm versions 1.x prior to 1.2.4 Apache Storm versions 2.x prior to 2.2.1 Description: The issue is related to a Command Injection vulnerability in the getTopologyHistory service of Apache Storm. This vulnerability can be exploited by...
@breautek/storm (>=2.0.0-rc.0, <=3.0.0-rc.0), create-react-solution (>=1.2.0, <=4.4.1) +2 more potentially affected by CVE-2021-23421 via merge-change (>=1.5.3, <=1.8.1)
merge-change NPM version =1.5.3, =2.0.0-rc.0, =1.2.0, =1.5.0, =4.0.0, =4.4.1 Source cves: CVE-2021-23421 Source advisory: OSV:GHSA-F9CV-665R-275H...
