1221 matches found
Apache NiFi - Information Disclosure
Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...
CVE-2023-34212
CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi The JndiJmsConnectionFactoryProvider Controller Service along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properti...
CVE-2023-34468-POC
CVE-2023-34468 — Apache NiFi 1.21.0 RCE PoC Remote Code Execution via H2 Database RUNSCRIPT in Apache NiFi = 1.21.0 Vulnerability Apache NiFi ships with an H2 database JAR bundled by default. The DBCPConnectionPool controller service can be configured to use this H2 driver. H2 supports a RUNSCRIP...
asf__nifi_CVE-2023-34468_1-21-00
nifi Apache NiFi is an easy to use, powerful, and reliable system to process and distribute data. Table of Contents Features Requirements Getting Started MiNiFi subproject Registry subproject Getting Help Documentation License Export Control Features Apache NiFi was made for dataflow. It supports...
CVE-2023-40037
CVE-2023-40037: Incomplete Validation of JDBC and JNDI Connection URLs in Apache NiFi Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs...
asf__nifi_CVE-2023-36542_1-22-0
Apache NiFi Status Resources Contacts !Track Issueshttps://img...
CVE-2023-34468
CVE-2023-34468: Remote Code Execution via DB Components in Apache NiFi The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code...
My-Exploits
My-Exploits Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of...
apache__nifi_CVE-2022-33140_1-16-22
Apache NiFi Status Resources Contacts !Track Issueshttps://img...
CVE-2023-34468-PoC
CVE-2023-34468 PoC for Apache NiFi Educational proof-of-concept PoC for CVE-2023-34468 affecting Apache NiFi versions prior to 1.22.0. This repository demonstrates how abuse of H2 JDBC URL configuration can lead to authenticated remote code execution RCE in vulnerable Apache NiFi installations...
CVE-2023-34468
CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC Short Python PoC for abusing an editable Apache NiFi ExecuteSQL processor with an H2 RUNSCRIPT payload to trigger remote command execution through a Bash reverse shell. For authorized testing and research only. Do not use against system...
CLEANSTART-2026-PK52336 yawkat LZ4 Java provides LZ4 compression for Java
Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...
CLEANSTART-2026-YJ89488 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
Security vulnerability affects the apache-nifi package. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes...
CLEANSTART-2026-QX36211 JLine is a Java library for handling console input
Security vulnerability affects the apache-nifi package. JLine is a Java library for handling console input...
CLEANSTART-2026-IA44862 yawkat LZ4 Java provides LZ4 compression for Java
Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...
CLEANSTART-2026-MV69619 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
Security vulnerability affects the apache-nifi package. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes...
CLEANSTART-2026-VT81725 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
Security vulnerability affects the apache-nifi package. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes...
CLEANSTART-2026-EA15585 yawkat LZ4 Java provides LZ4 compression for Java
Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...