Server side request forgery (ssrf)

Server-Side Request Forgery SSRF vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even...

CVE-2022-44730 Apache XML Graphics Batik: Information disclosure vulnerability

Server-Side Request Forgery SSRF vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL...

CVE-2022-44730

Server-Side Request Forgery SSRF vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL...

PT-2023-7021 · Apache +2 · Apache Xml Graphics Batik +2

Name of the Vulnerable Software and Affected Versions: Apache XML Graphics Batik version 1.16 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability in Apache XML Graphics Batik. This vulnerability can be exploited by a malicious SVG, which could trigger the loading...

Apache Airflow Information Disclosure Vulnerability (CNVD-2023-85617)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow Spark Provider...

CVE-2023-40037

CVE-2023-40037 affects Apache NiFi versions 1.21.0 through 1.23.0, where JDBC/JNDI JMS access in several Processors and Controller Services uses connection URL validation that is insufficient against crafted inputs. An authenticated, authorized user can bypass validation by formatting inputs clev...

CVE-2023-39553

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read fil...

CVE-2023-36877

Azure Apache Oozie Spoofing Vulnerability...

CVE-2023-36881

Azure Apache Ambari Spoofing Vulnerability...

Spoofing

Azure Apache Hadoop Spoofing Vulnerability...

CVE-2023-36881 Azure Apache Ambari Spoofing Vulnerability

...

CVE-2023-36881 Azure Apache Ambari Spoofing Vulnerability

...

CVE-2023-36881

CVE-2023-36881 corresponds to a spoofing vulnerability in Azure Apache Ambari. Public sources in the connected data identify Azure HDInsights/Azure Arc context and map the impact to spoofing, with an ability to impersonate or pre-emptively act as another user. The MSRC advisory indicates updates ...

CVE-2023-36877

Technical details about CVE-2023-36877 (Azure Apache Oozie Spoofing Vulnerability) are not available in the provided documents. No affected versions, root cause, or mitigation are specified here. Monitor for updates from official advisories.

CVE-2023-36877 Azure Apache Oozie Spoofing Vulnerability

...

CVE-2023-38188

CVE-2023-38188 is a spoofing vulnerability affecting Azure Apache Hadoop components in Azure HDInsight. Public sources (NCSC) indicate pre-authentication access to impersonate another user, enabling user-interface spoofing and potential privilege-lifting within affected Azure HDInsight/Azure Hado...

CVE-2023-35393

CVE-2023-35393 corresponds to a spoofing vulnerability in Azure Apache Hive affecting Azure HDInsight/Hive components. The NCSC advisory summarizes the impact as "Pretend to be another user" and recommends installing the updates from Microsoft MSRC/MS-Update guidance. The available sources label ...

CVE-2023-35393 Azure Apache Hive Spoofing Vulnerability

...

RLSA-2023:4418 Important: mod_auth_openidc:2.3 security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag...

Azure Apache Hive Spoofing Vulnerability

...