CVE-2025-59059-Misattributed-RCE-in-Apache-Ranger-Static-Analysis-Correction

CVE-2025-59059: Apache Ranger における誤った帰属の RCE — 訂正 CVE: CVE-2025-59059 影響を受けるバージョン: Apache Ranger "NashornScriptEngineCreator のリモートコード実行の脆弱性が Apache Ranger バージョン = 2.7.0 で報告されています。" これは誤りであり、少なくとも誤解を招く。NashornScriptEngineCreator は脆弱性のあるクラスではない。どちらかと言えば、コードベース内の Nashorn 関連コンポーネントのうち、より堅牢化されている方だ —...

CVE-2026-28672

CVE-2026-28672 — Apache Ranger UnixUserGroupBuilder の OS コマンドインジェクション Apache Ranger の user-sync（unixusersync）モジュールにおける OS コマンドインジェクションの実行可能な PoC 再現コードです。 同期された各ユーザーのグループを列挙する際、UnixUserGroupBuilder はシェルを介して id コマンドを実行し、ユーザー名 をコマンドラインに連結します： //...

Exploit for Command Injection in Apache Ranger

CVE-2026-28672 — Apache Ranger UnixUserGroupBuilder OS comma...

CVE-2026-55814

A flaw was found in Apache Ranger. This vulnerability allows a remote attacker to access sensitive plugin data through the download APIs without requiring any authentication. This unauthorized access can lead to information disclosure, potentially exposing critical configuration or operational...

GHSA-6QC3-V8FV-FV9J Apache Ranger has a Command Injection vulnerability

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8...

Apache Ranger has a Command Injection vulnerability

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8...

CVE-2026-65942

TLS hostname verification issue in Apache Ranger Client Code in versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65948

UnixAuth lacks brute-force protection in Apache Ranger versions = 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65945

Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-55799

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-42537

Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-44416

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-40920

Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-32227

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue...

CVE-2026-55814

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-28672

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8...

CVE-2026-28672 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8...

CVE-2026-28672

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8...

CVE-2026-28672 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8...

CVE-2026-28672 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8...