CVE-2024-8184 vulnerabilities

Vulnerabilities for packages: apache-nifi, kafka, jenkins, druid, solr, spark, apache-tika, confluent-kafka-jre-bcfips, zookeeper-fips, confluent-kafka, cassandra-reaper, cloudwatch-exporter, strimzi-kafka-operator, celeborn, zookeeper, spark-fips...

CVE-2024-47554 vulnerabilities

Vulnerabilities for packages: apache-nifi, druid, hadoop-client-modules, hadoop-fips, kserve-modelmesh, logstash, wildfly, kafka, management-api-for-apache-cassandra-5.0, confluent-kafka-jre-bcfips, celeborn, strimzi-kafka-operator, zookeeper-fips, management-api-for-apache-cassandra-4.0,...

GHSA-735F-PC8J-V9W8 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, wavefront-proxy, sonarqube-10, tez, confluent-kafka, opensearch, apache-nifi, thingsboard, kube-fluentd-operator, celeborn, trino...

CVE-2024-7254 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, wavefront-proxy, sonarqube-10, tez, confluent-kafka, opensearch, apache-nifi, thingsboard, kube-fluentd-operator, celeborn, trino...

Malicious code in confluent-docker-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bc7d66b033c3d09c07ce3226cd534199a9f8cb2200a79035526192fb140b94d9 The package is designed to exfiltrate basic data, like hostname and OS details, as well as collect information about the stacktrace it's imported from. ---...

MAL-2024-9963 Malicious code in confluent-docker-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bc7d66b033c3d09c07ce3226cd534199a9f8cb2200a79035526192fb140b94d9 The package is designed to exfiltrate basic data, like hostname and OS details, as well as collect information about the stacktrace it's imported from. ---...

GHSA-34JH-P97F-MPXF vulnerabilities

Vulnerabilities for packages: superset, py3-pipenv, kubeflow-volumes-web-app, datadog-agent, confluent-docker-utils, jwt-tool, kubeflow-jupyter-web-app, airflow, py3-urllib3, dask-gateway, checkov, mlflow, reflex, k8s-sidecar, kubeflow-pipelines-visualization-server, ggshield, kubeflow-katib,...

CVE-2024-37891 vulnerabilities

Vulnerabilities for packages: superset, py3-pipenv, kubeflow-volumes-web-app, datadog-agent, confluent-docker-utils, jwt-tool, kubeflow-jupyter-web-app, airflow, py3-urllib3, dask-gateway, checkov, mlflow, reflex, k8s-sidecar, kubeflow-pipelines-visualization-server, ggshield, kubeflow-katib,...

@-0/browser (>=0.3.1 <=0.3.61), @cfxjs/extension-runtime (>=0.0.1 <=0.0.4) +41 more potentially affected by CVE-2024-29650 via @thi.ng/paths (>=1.6.6 <=4.2.14)

@thi.ng/paths NPM version =1.6.6, =0.3.1, =0.0.1, =0.0.2, =0.0.1, =0.2.0, =0.2.0, =0.0.4, =0.0.3, =0.0.13, =0.0.1, =1.0.5, =0.0.1, =0.3.0, =0.3.2 and more Source cves: CVE-2024-29650 Source advisory: OSV:GHSA-8PPR-WWW8-HFJX...

snappy-java's missing upper bound check on chunk length can lead to Denial of Service (DoS) impact

Summary snappy-java is a data compression library in Java. Its SnappyInputStream was found to be vulnerable to Denial of Service DoS attacks when decompressing data with a too-large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. Scope All...

Microsoft is committed to the success of Java developers

Hi, Spring fans! This is a guest post from our friend Julia Liuson, President, Developer Division, Microsoft As a company, we are committed to making Java developers as efficient and productive as possible. This commitment means empowering you to use any tool, framework, and application server on...

A Bootiful Podcast: Event streaming guru Jan Svoboda on Apache Kafka Design Patterns

Hi, Spring fans! In this installment Josh Long @starbuxman talks to event streaming guru at Confluent, the company behind Apache Kafka, Jan Svoboda about Apache Kafka design patterns. Kafka summit in London Europe end of April 2022 Kafka Summit London 2022 | April 25-26 | London, UK the Confluent...

CVE-2021-33924

Confluent Ansible cp-ansible version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information...

CVE-2021-33923

Insecure permissions in Confluent Ansible cp-ansible 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information private keys, state database...

CVE-2021-33923

Insecure permissions in Confluent Ansible cp-ansible 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information private keys, state database...

CVE-2021-33924

Confluent Ansible cp-ansible version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information...

CVE-2021-33924

Confluent Ansible cp-ansible version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information...

Information disclosure

Confluent Ansible cp-ansible version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information...

Information disclosure

Insecure permissions in Confluent Ansible cp-ansible 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information private keys, state database...

CVE-2021-33924

Confluent Ansible cp-ansible version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information...