936 matches found
Apache NiFi - Information Disclosure
Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...
CVE-2024-56512-Apache-NiFi-Exploit
NiFiExploit Una herramienta para explotar la vulnerabilidad CVE-2024-56512 en Apache NiFi , que permite el acceso no autorizado a datos sensibles a través de APIs mal aseguradas...
nifi-CVE-2026-39816-poc
Apache NiFi CVE-2026-39816 POC Demostración de prueba de concepto para CVE-2026-39816, una omisión del permiso EXECUTECODE en Apache NiFi 2.8.0 que permite a un diseñador de flujos al que se le han denegado deliberadamente los privilegios de ejecución de código ejecutar Groovy arbitrario en la JV...
CVE-2023-34468
CVE-2023-34468 Exploit Overview This repository provides a Python-based exploit tool for CVE-2023-34468 , a critical remote code execution vulnerability CVSS 9.8 in Apache NiFi versions 0.0.2 through 1.21.0. It allows authenticated users to execute arbitrary code by manipulating H2 database...
CLEANSTART-2026-GQ65848 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...
CLEANSTART-2026-OF13352 jackson-databind binds a JSON string to a javax
Security vulnerability affects the apache-nifi package. jackson-databind binds a JSON string to a javax...
CLEANSTART-2026-JZ19547 Apache NiFi 1
Security vulnerability affects the apache-nifi package. Apache NiFi 1...
CLEANSTART-2026-CX77611 Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS)
Security vulnerability affects the apache-nifi package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS...
CLEANSTART-2026-SR72438 application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2
Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...
CLEANSTART-2026-BR90501 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)
Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...
CLEANSTART-2026-WX23354 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...
CLEANSTART-2026-KF94035 Out-of-bounds memory operations in org
Security vulnerability affects the apache-nifi package. Out-of-bounds memory operations in org...
asf__nifi_CVE-2023-34468_1-21-00
nifi Apache NiFi is an easy to use, powerful, and reliable system to process and distribute data. Table of Contents Features Requirements Getting Started MiNiFi subproject Registry subproject Getting Help Documentation License Export Control Features Apache NiFi was made for dataflow. It supports...
CVE-2023-34212
CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi The JndiJmsConnectionFactoryProvider Controller Service along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properti...
CVE-2023-34468-POC
CVE-2023-34468 — Apache NiFi 1.21.0 RCE PoC Remote Code Execution via H2 Database RUNSCRIPT in Apache NiFi = 1.21.0 Vulnerability Apache NiFi ships with an H2 database JAR bundled by default. The DBCPConnectionPool controller service can be configured to use this H2 driver. H2 supports a RUNSCRIP...
CVE-2023-40037
CVE-2023-40037: Incomplete Validation of JDBC and JNDI Connection URLs in Apache NiFi Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs...
asf__nifi_CVE-2023-36542_1-22-0
Apache NiFi Status Resources Contacts !Track Issueshttps://img...
CVE-2023-34468
CVE-2023-34468: Remote Code Execution via DB Components in Apache NiFi The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code...
My-Exploits
My-Exploits Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of...