1167 matches found
Xxe
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...
CVE-2021-44145 Apache NiFi information disclosure by XXE
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...
CVE-2021-44145
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...
CVE-2021-44145
CVE-2021-44145 affects the Apache NiFi TransformXML processor (before 1.15.1). An authenticated user could configure an XSLT file that contains external entity calls, potentially revealing sensitive information due to an XXE. The issue is documented across multiple sources, with remediation advis...
PT-2021-24043
Name of the Vulnerable Software and Affected Versions: Apache NiFi versions prior to 1.15.1 Description: The issue allows an authenticated user to configure an XSLT file in the TransformXML processor, which may include malicious external entity calls, potentially revealing sensitive information...
CVE-2021-44145: Exposure of Sensitive Information to an Unauthorized Actor
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information...
Apache NiFi OS Command Injection Vulnerability
Apache NiFi is a data processing and distribution system from the Apache Foundation in the United States. The system is primarily used for data routing, transformation, and system mediation logic. versions prior to Apache NiFi MiNiFi C version 0.5.0 have security vulnerabilities that allow an...
GHSA-3J6G-HXX5-3Q26 vulnerabilities
Vulnerabilities for packages: hive...
GHSA-3J6G-HXX5-3Q26 vulnerabilities
Vulnerabilities for packages: apache-nifi...
CVE-2021-38153 vulnerabilities
Vulnerabilities for packages: hive...
CVE-2021-38153 vulnerabilities
Vulnerabilities for packages: apache-nifi...
CVE-2021-33191
From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...
CVE-2021-33191
From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...
Command injection
From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...
CVE-2021-33191 MiNiFi CPP arbitrary script execution is possible on the agent's host machine through the c2 protocol
From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...
CVE-2021-33191
From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...
CVE-2021-33191: Improper Neutralization of Special Elements used in an OS Command
From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...
Apache NiFi 操作系统命令注入漏洞
Apache NiFi is a data processing and distribution system from the Apache Foundation in the United States. The system is primarily used for data routing, transformation, and system mediation logic. versions prior to Apache NiFi MiNiFi C version 0.5.0 have security vulnerabilities that allow an...
PT-2021-20073
Name of the Vulnerable Software and Affected Versions Apache NiFi MiNiFi C++ versions 0.5.0 through 0.9.x Description The c2 protocol in Apache NiFi MiNiFi C++ implements an "agent-update" command designed to patch the application binary. This command defaults to calling a trusted binary but can ...
