CVE-2023-34212

CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi The JndiJmsConnectionFactoryProvider Controller Service along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properti...

CVE-2023-34468-POC

CVE-2023-34468 — Apache NiFi 1.21.0 RCE PoC Remote Code Execution via H2 Database RUNSCRIPT in Apache NiFi = 1.21.0 Vulnerability Apache NiFi ships with an H2 database JAR bundled by default. The DBCPConnectionPool controller service can be configured to use this H2 driver. H2 supports a RUNSCRIP...

asf__nifi_CVE-2023-34468_1-21-00

nifi Apache NiFi is an easy to use, powerful, and reliable system to process and distribute data. Table of Contents Features Requirements Getting Started MiNiFi subproject Registry subproject Getting Help Documentation License Export Control Features Apache NiFi was made for dataflow. It supports...

CVE-2023-40037

CVE-2023-40037: Incomplete Validation of JDBC and JNDI Connection URLs in Apache NiFi Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs...

Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

asf__nifi_CVE-2023-36542_1-22-0

Apache NiFi Status Resources Contacts !Track Issueshttps://img...

CVE-2023-34468

CVE-2023-34468: Remote Code Execution via DB Components in Apache NiFi The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code...

My-Exploits

My-Exploits Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of...

apache__nifi_CVE-2022-33140_1-16-22

Apache NiFi Estado Recursos Contactos !Track Issueshttps://img...

CVE-2023-34468-PoC

CVE-2023-34468 PoC for Apache NiFi Educational proof-of-concept PoC for CVE-2023-34468 affecting Apache NiFi versions prior to 1.22.0. This repository demonstrates how abuse of H2 JDBC URL configuration can lead to authenticated remote code execution RCE in vulnerable Apache NiFi installations...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: apache-nifi, apache-nifi-registry, spark, akhq, scala, strimzi-kafka-operator, infinispan, cass-config-builder, opensearch, keycloak-config-cli, flyway, keycloak, tez, gradle, sonarqube, apache-tika, spdx-tools-java, logstash, druid, apicurio-registry, wildfly,...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: apache-nifi, apache-nifi-registry, spark, akhq, scala, strimzi-kafka-operator, infinispan, cass-config-builder, opensearch, keycloak-config-cli, flyway, keycloak, tez, gradle, sonarqube, apache-tika, spdx-tools-java, logstash, druid, apicurio-registry, wildfly,...

CVE-2023-34468

CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC Short Python PoC for abusing an editable Apache NiFi ExecuteSQL processor with an H2 RUNSCRIPT payload to trigger remote command execution through a Bash reverse shell. For authorized testing and research only. Do not use against system...

CVE-2024-56512-Apache-NiFi-Exploit

NiFiExploit A tool to exploit the CVE-2024-56512 vulnerability in Apache NiFi , which allows unauthorized access to sensitive data through improperly secured APIs...

nifi-CVE-2026-39816-poc

Apache NiFi CVE-2026-39816 POC Proof-of-concept demonstration for CVE-2026-39816, an EXECUTECODE permission bypass in Apache NiFi 2.8.0 that lets a flow designer who has been deliberately denied code-execution privileges run arbitrary Groovy in the NiFi JVM via the graph bundle's ExecuteGraphQuer...

CVE-2023-34468

CVE-2023-34468 Exploit Overview This repository provides a Python-based exploit tool for CVE-2023-34468 , a critical remote code execution vulnerability CVSS 9.8 in Apache NiFi versions 0.0.2 through 1.21.0. It allows authenticated users to execute arbitrary code by manipulating H2 database...

CLEANSTART-2026-GQ65848 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-OF13352 jackson-databind binds a JSON string to a javax

Security vulnerability affects the apache-nifi package. jackson-databind binds a JSON string to a javax...

CLEANSTART-2026-MD90103 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-XF54528 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...