666 matches found
CVE-2024-12798 vulnerabilities
Vulnerabilities for packages: cassandra-reaper, cassandra, sonarqube, management-api-for-apache-cassandra-4.1, akhq, cassandra-fips, tez, ontop, sonarqube-10, thingsboard, kserve-modelmesh, management-api-for-apache-cassandra-5.0, ontop-fips, dependency-track, sonar-scanner-cli, trino, apache-nif...
GHSA-MQVR-2RP8-J7H4 vulnerabilities
Vulnerabilities for packages: apache-nifi...
CVE-2024-38829 vulnerabilities
Vulnerabilities for packages: apache-nifi...
CVE-2024-52067
Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causi...
CVE-2024-52067 Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log
Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causi...
CVE-2024-52067 Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log
Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causi...
CVE-2024-52067
CVE-2024-52067 affects Apache NiFi 1.16.0–1.28.0 and 2.0.0-M1–2.0.0-M4. The issue is optional debug logging of Parameter Context values during flow synchronization, which an authorized admin could enable to write parameter names and values to logs. Deployments with the default Logback config do n...
CVE-2024-52067 Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log
Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causi...
Apache NiFi 日志信息泄露漏洞
Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation, and system brokering logic. A log information disclosure vulnerability exists in Apache NiFi versions 1.16.0 to 1.28.0 and 2.0.0-M1 to 2.0.0-M4,...
GHSA-2X2G-32R7-P4X8 vulnerabilities
Vulnerabilities for packages: prometheus-jmx-exporter, logstash, thingsboard, druid, apache-nifi, strimzi-kafka-operator...
CVE-2024-31141 vulnerabilities
Vulnerabilities for packages: prometheus-jmx-exporter, logstash, thingsboard, druid, apache-nifi, strimzi-kafka-operator...
Apache NiFi Cross-site Scripting vulnerability
Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, whic...
GHSA-7MQJ-XGF8-P59V Apache NiFi Cross-site Scripting vulnerability
Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, whic...
CVE-2024-45477
Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, whic...
CVE-2024-45477 Apache NiFi: Improper Neutralization of Input in Parameter Description
Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, whic...
CVE-2024-45477 Apache NiFi: Improper Neutralization of Input in Parameter Description
Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, whic...
CVE-2024-45477
Apache NiFi is affected by CVE-2024-45477 due to improper neutralization of input in the Parameter Context description field. The vulnerability exists in NiFi versions 1.10.0–1.27.0 and 2.0.0-M1–2.0.0-M3, where an authenticated user with permission to configure a Parameter Context can inject arbi...
CVE-2024-45477 Apache NiFi: Improper Neutralization of Input in Parameter Description
Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, whic...
Apache NiFi 跨站脚本漏洞
Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation, and system brokering logic. A cross-site scripting vulnerability exists in Apache NiFi versions 1.10.0 through 1.27.0 and 2.0.0-M1 through...