CVE-2023-34468

CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC 편집 가능한 Apache NiFi ExecuteSQL 프로세서를 악용하여 H2 RUNSCRIPT 페이로드로 Bash 리버스 셸을 통한 원격 명령 실행을 트리거하는 간단한 Python PoC입니다. 승인된 테스트 및 연구 목적으로만 사용하십시오. 소유하지 않았거나 테스트에 대한 명시적 허가를 받지 않은 시스템에는 사용하지 마십시오. 동작 방식 root@kitploit: ExecuteSQL processor update -...

CVE-2023-40037

CVE-2023-40037: Неполная проверка URL-адресов подключения JDBC и JNDI в Apache NiFi Apache NiFi версий с 1.21.0 по 1.23.0 поддерживает доступ JDBC и JNDI JMS в нескольких процессорах и сервисах контроллера с проверкой URL-адресов подключения, которая не обеспечивает достаточной защиты от специаль...

CVE-2023-34468

CVE-2023-34468: Apache NiFi의 DB 구성 요소를 통한 원격 코드 실행 Apache NiFi 0.0.2부터 1.21.0까지의 DBCPConnectionPool 및 HikariCPConnectionPool 컨트롤러 서비스는 인증되고 권한이 부여된 사용자가 사용자 정의 코드 실행을 가능하게 하는 H2 드라이버를 사용하여 데이터베이스 URL을 구성할 수 있도록 허용합니다. 공급업체 공개: 이 취약점에 대한 공급업체의 공개 및 수정 사항은 여기에서 확인할 수 있습니다. 요구 사항: 이 취약점에는 다음이 필요합니다:...

CVE-2023-34212

CVE-2023-34212: Десериализация Java через компоненты JNDI в Apache NiFi Сервис контроллера JndiJmsConnectionFactoryProvider вместе с процессорами ConsumeJMS и PublishJMS в Apache NiFi с версии 1.8.0 по 1.21.0 позволяют аутентифицированному и авторизованному пользователю настраивать свойства URL и...

CVE-2024-56512-Apache-NiFi-Exploit

NiFiExploit Apache NiFi の CVE-2024-56512 脆弱性を悪用するためのツールです。この脆弱性により、適切に保護されていない API を通じて機密データへの不正アクセスが可能になります。...

nifi-CVE-2026-39816-poc

Apache NiFi CVE-2026-39816 POC Демонстрация proof-of-concept для CVE-2026-39816 — обход разрешения EXECUTECODE в Apache NiFi 2.8.0, который позволяет разработчику потоков, которому было намеренно отказано в привилегиях выполнения кода, запускать произвольный Groovy в JVM NiFi через процессор...

apache__nifi_CVE-2022-33140_1-16-22

Apache NiFi Статус Ресурсы Контакты !Track Issueshttps://img.s...

Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

asf__nifi_CVE-2023-36542_1-22-0

Apache NiFi स्थिति संसाधन संपर्क !Track Issueshttps://img.shie...

asf__nifi_CVE-2023-34468_1-21-00

O Apache NiFi é um sistema fácil de usar, poderoso e confiável para processar e distribuir dados. Sumário Recursos Requisitos Primeiros Passos Subprojeto MiNiFi Subprojeto Registry Obtendo Ajuda Documentação...

CVE-2023-34468

CVE-2023-34468 Exploit Übersicht Dieses Repository stellt ein Python-basiertes Exploit-Tool für CVE-2023-34468 bereit, eine kritische Schwachstelle zur Remote-Code-Ausführung CVSS 9.8 in Apache NiFi Versionen 0.0.2 bis 1.21.0. Es ermöglicht authentifizierten Benutzern, beliebigen Code auszuführen...

CVE-2023-34468-PoC

PoC CVE-2023-34468 per Apache NiFi Proof-of-concept PoC didattico per CVE-2023-34468 che riguarda Apache NiFi versioni precedenti alla 1.22.0. Questo repository dimostra come l'abuso della configurazione degli URL JDBC di H2 possa portare a esecuzione remota di codice RCE autenticata nelle...

CVE-2023-34468-POC

CVE-2023-34468 — Apache NiFi 1.21.0 RCE PoC Esecuzione remota di codice tramite istruzione RUNSCRIPT del database H2 in Apache NiFi = 1.21.0 Vulnerabilità Apache NiFi include di default un JAR del database H2. Il controller service DBCPConnectionPool può essere configurato per utilizzare questo...

GHSA-GGG2-9786-HWC8 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, apache-nifi-registry...

CVE-2026-73508 vulnerabilities

Vulnerabilities for packages: akhq, apache-pulsar, spark, strimzi-kafka-operator, opensearch, apicurio-registry, apache-nifi, zipkin, keycloak, thingsboard, celeborn, tez, druid, management-api-for-apache-cassandra-5.0...

CVE-2026-41706 vulnerabilities

Vulnerabilities for packages: geoserver, apache-nifi-registry...

GHSA-X2R2-RVHQ-2MQV vulnerabilities

Vulnerabilities for packages: geoserver, apache-nifi-registry...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68981

The CVE-2026-68981 issue affects Apache NiFi versions 1.5.0 through 2.10.0, where gzip-encoded HTTP requests to the REST API are processed via a Jersey encoding filter. A configurable maximum is enforced on the compressed payload rather than the decompressed output, which could allow a malicious ...

CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...