Apache Hadoop 2.7.3 - 2.7.4 YARN NodeManager Information Disclosure Vulnerability

Apache Hadoop is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:hadoop"...

CVE-2017-15718

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

CVE-2017-15718

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

Memory corruption

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

CVE-2017-15718

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

CVE-2017-15718

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

CVE-2017-15718

CVE-2017-15718 affects Apache Hadoop, specifically the YARN NodeManager in Hadoop 2.7.3 and 2.7.4, which can leak the password for the NodeManager credential store provider to YARN Applications. The vulnerability is an information disclosure in the NodeManager component that could expose credenti...

PT-2018-3933

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 2.7.3 through 2.7.4 Description The issue is related to errors in managing registration data in the YARN NodeManager component of Apache Hadoop. This can lead to unauthorized access to arbitrary passwords. The YARN...

CVE-2017-15718: Undefined Security Weakness

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

allfreeknitting.com XSS vulnerability

Open Bug Bounty ID: OBB-429502 Description| Value ---|--- Affected Website:| allfreeknitting.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

Apache Hadoop Insufficient Access Control Vulnerability

Apache Hadoop is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:hadoop"; i...

Unauthorized Access

Apache Hadoop Mapreduce is vulnerable to unauthorized access. If a file with world-readable access permissions is localized through YARN's localization mechanism, the file will be stored in a world-readable location that can then be accessed by a malicious user...

CVE-2017-3166

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any...

Design/Logic Flaw

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any...

CVE-2017-3166

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any...

CVE-2017-3166

CVE-2017-3166 affects Apache Hadoop: if a file in an encryption zone is world-readable and localized via YARN localization, it can be stored in a world-readable location and shared with any requesting application. Affected Hadoop versions per the document: 2.6.1–2.6.5, 2.7.0–2.7.3, and 3.0.0-alph...

PT-2017-4254

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 2.6.1 through 2.6.5 Apache Hadoop versions 2.7.0 through 2.7.3 Apache Hadoop version 3.0.0-alpha1 Description The issue is related to incorrect file permission assignments in Apache Hadoop. This can allow a remote attack...

CVE-2017-3166: Incorrect Permission Assignment for Critical Resource

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any...

Cross-site Request Forgery (CSRF)

Hadoop YARN is vulnerable to cross-site request forgery CSRF attacks. The application does not have any CSRF protection, allowing an attacker to send requests to the Hadoop cluster...

CVE-2016-3086

The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications...