Apache NiFi 安全漏洞

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. A security vulnerability exists in Apache NiFi that stems from the fact that when creating or updating credentials...

GHSA-57J2-W4CX-62H2 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, management-api-for-apache-cassandra-4.0, scala, management-api-for-apache-cassandra-5.0, management-api-for-apache-cassandra-4.1...

GHSA-57J2-W4CX-62H2 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, cassandra-reaper, scala...

CVE-2020-36518 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, management-api-for-apache-cassandra-4.0, scala, management-api-for-apache-cassandra-5.0, management-api-for-apache-cassandra-4.1...

CVE-2020-36518 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, cassandra-reaper, scala...

GHSA-RFMP-JVR7-HX78 Inadequate Encryption Strength in Apache NiFi

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced...

Inadequate Encryption Strength in Apache NiFi

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced...

GHSA-3PP3-77J6-8PH6 Missing Authentication for Critical Function in Apache NiFi

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token one-time password mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens,...

GHSA-G644-PR5V-VPPF Insertion of Sensitive Information into Log File in Apache NiFi Stateless

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext...

Insertion of Sensitive Information into Log File in Apache NiFi Stateless

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext...

GHSA-Q4XF-3PMQ-3HW8 Improper Restriction of XML External Entity Reference in Apache NiFi

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...

Improper Restriction of XML External Entity Reference in Apache NiFi

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...

Insertion of Sensitive Information into Log File in Apache NiFi

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was...

GHSA-7Q8G-GPFP-V8GX Insertion of Sensitive Information into Log File in Apache NiFi

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was...

GHSA-W4FJ-CCR6-7PCP Apache NiFi Insertion of Sensitive Information into Log File

An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present...

Apache NiFi Insertion of Sensitive Information into Log File

An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present...

GHSA-PQHQ-XX62-2V2P Cross-site scripting in Apache NiFi

A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers...

Cross-site scripting in Apache NiFi

A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers...

Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...

GHSA-RQ96-QHC5-VM4R Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...