Design/Logic Flaw

Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, stores a cleartext BigSheets password in a configuration file, which allows local users to obtain sensitive information by reading this file...

Design/Logic Flaw

Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allows physically proximate attackers to obtain sensitive information by reading password fields...

CVE-2015-4928

Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allows physically proximate attackers to obtain sensitive information by reading password fields...

CVE-2015-4940

CVE-2015-4940 affects Apache Ambari before 2.1 as used in IBM Infosphere BigInsights 4.x before 4.1, where a configuration file stores the BigSheets password in clear text. This allows a local attacker who can read the Ambari configs to obtain sensitive information. IBM’s bulletin notes that the ...

CVE-2015-4928

The CVE-2015-4928 issue affects Apache Ambari 2.1 as used in IBM InfoSphere BigInsights 4.x before 4.1, where the Configs screen displays passwords in cleartext. This allows a local attacker with access to the Ambari UI to read sensitive passwords by viewing the configuration screens. IBM’s secur...

CVE-2015-4940

Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, stores a cleartext BigSheets password in a configuration file, which allows local users to obtain sensitive information by reading this file...

Apache Ambari Open Redirect Vulnerability

Apache Ambari is the tool to provision, manage, and monitor Apache Hadoop clusters. An open redirection security vulnerability exists in Apache Ambari versions prior to 2.1.2. A remote attacker can exploit this vulnerability to redirect a user to an arbitrary website and perform a phishing attack...

CVE-2015-3270

Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors, possibly related to changing passwords...

CVE-2015-3186

Cross-site scripting XSS vulnerability in Apache Ambari before 2.1.0 allows remote authenticated cluster operator users to inject arbitrary web script or HTML via the note field in a configuration change...

Cross site scripting

Cross-site scripting XSS vulnerability in Apache Ambari before 2.1.0 allows remote authenticated cluster operator users to inject arbitrary web script or HTML via the note field in a configuration change...

Open redirect

Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter...

Design/Logic Flaw

Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors, possibly related to changing passwords...

CVE-2015-1775

Server-side request forgery SSRF vulnerability in the proxy endpoint api/v1/proxy in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call...

CVE-2015-5210

Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter...

CVE-2015-5210

CVE-2015-5210 is an open redirect vulnerability in Apache Ambari prior to 2.1.2. The issue allows remote attackers to redirect users to arbitrary websites and conduct phishing via a URL in the targetURI parameter. Affected product is Apache Ambari; the root cause is an open redirect in the handli...

CVE-2015-3270

Apache Ambari is affected by a privilege-escalation vulnerability affecting versions before 2.0.2 and 2.1.x before 2.1.1. Remote authenticated users can obtain administrative privileges via unspecified vectors (possibly related to password changes). Root cause: privilege escalation in the Ambari ...

CVE-2015-1775

Apache Ambari (1.5.0–2.0.2) is vulnerable to SSRF via the proxy endpoint api/v1/proxy. The issue allows remote authenticated users to perform port scans and access unsecured services through a crafted REST call, due to improper validation in the proxy handling. Impact details in multiple sources ...

CVE-2015-3270

Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors, possibly related to changing passwords...

CVE-2015-1775

Server-side request forgery SSRF vulnerability in the proxy endpoint api/v1/proxy in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call...

CVE-2015-3186

Apache Ambari 1.5.0 through 2.0.2 is affected by an XSS in the note field of a configuration change. The vulnerability arises when authenticated remote cluster operators can inject arbitrary script/HTML, with impact described as partial integrity loss and no confidentiality or availability impact...