Apache NiFi cross-site scripting vulnerability (CNVD-2023-9665850)

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. Apache NiFi suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and...

Cross Site Scripting (XSS)

Apache NiFi is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper sanitization of user input. This issue can be exploited by an attacker via crafting specific malicious url to execute Javascript within the session context of the authenticated user...

Improper Neutralization of Input in Advanced User Interface for Jolt

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, the...

GHSA-68PR-6FJC-WMGM Improper Neutralization of Input in Advanced User Interface for Jolt

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, the...

CVE-2023-49145

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, the...

Cross site scripting

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, the...

CVE-2023-49145

Apache NiFi

CVE-2023-49145 Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, the...

CVE-2023-49145 Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, the...

PT-2023-8006 · Apache · Apache Nifi

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions 0.7.0 through 1.23.2 Description: The issue is related to the JoltTransformJSON Processor in Apache NiFi, which provides an advanced configuration user interface vulnerable to DOM-based cross-site scripting. If an...

Metasploit Weekly Wrap-Up

Apache MQ and Three Cisco Modules in a Trenchcoat This week’s release has a lot of new content and features modules targeting two major recent vulnerabilities that got a great deal of attention: CVE-2023-46604 targeting Apache MQ resulting in ransomware deployment and CVE-2023-20198 targeting Cis...

Apache NiFi Credentials Gather

This module will grab Apache NiFi credentials from various files on Linux. Module Options msf use post/linux/gather/apachenificredentials msf postapachenificredentials show actions ...actions... msf postapachenificredentials set ACTION msf postapachenificredentials show options ...show and set...

The vulnerability of the InvokeHTTP component in the Apache NiFi MiNiFi data processing platform, which exists due to insufficient verification of certificate authenticity, allows attackers to compromise data integrity.

The vulnerability of the InvokeHTTP component in the Apache NiFi MiNiFi data processing platform exists due to insufficient verification of certificate authenticity. Exploiting this vulnerability allows an attacker to compromise data integrity from a remote location...

CVE-2023-46120 vulnerabilities

Vulnerabilities for packages: trino, cassandra-reaper...

CVE-2023-46120 vulnerabilities

Vulnerabilities for packages: trino, cassandra-reaper...

GHSA-MM8H-8587-P46H vulnerabilities

Vulnerabilities for packages: trino, cassandra-reaper...

GHSA-MM8H-8587-P46H vulnerabilities

Vulnerabilities for packages: trino, cassandra-reaper...

The vulnerability of the Remote ResourceHandler component of the Apache NiFi data processing platform allows a attacker to execute arbitrary code.

The vulnerability of the Remote ResourceHandler component of the Apache NiFi data processing platform is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the DBCPConnectionPool and HikariCPConnectionPool control servers of the Apache NiFi data processing platform allows a hacker to execute arbitrary code.

The vulnerability of the DBCPConnectionPool and HikariCPConnectionPool control servers of the Apache NiFi data processing platform is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Apache NiFi data processing platform, related to insufficient comparison, allows a attacker to gain unauthorized access to protected information.

The vulnerability of the Apache NiFi data processing platform is related to insufficient comparison. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...