denr.gov.ph Cross Site Scripting vulnerability OBB-1979673

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| denr.gov.ph ---|--- Open Bug Bounty...

org.apache.nifi:nifi-cluster-authorization-provider (0.2.1), org.apache.nifi:nifi-framework-cluster (0.2.1) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.2.1)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.2.1 -...

org.apache.nifi:nifi-cluster-authorization-provider (0.4.0), org.apache.nifi:nifi-framework-cluster (0.4.0) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.4.0)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.4.0 -...

org.apache.nifi:nifi-cluster-authorization-provider (0.7.3), org.apache.nifi:nifi-framework-cluster (0.7.3) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.7.3)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.7.3 -...

org.apache.nifi:nifi-cluster-authorization-provider (0.7.4), org.apache.nifi:nifi-framework-cluster (0.7.4) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.7.4)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.7.4 -...

org.apache.nifi.minifi:minifi-c2-assembly (>=0.2.0, <=0.3.0), org.apache.nifi.minifi:minifi-c2-provider-nifi-rest (>=0.2.0, <=0.3.0) +16 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (>=1.0.0-beta, <=1.4.0)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version =1.0.0-beta, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.2.0, =1.2.0, =1.4.0 and more Source cves: CVE-2017-15703 Source advisory:...

org.apache.nifi:nifi-cluster-authorization-provider (0.3.0), org.apache.nifi:nifi-framework-cluster (0.3.0) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.3.0)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.3.0 -...

org.apache.nifi:nifi-cluster-authorization-provider (0.7.1), org.apache.nifi:nifi-framework-cluster (0.7.1) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.7.1)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.7.1 -...

org.apache.nifi:nifi-cluster-authorization-provider (0.6.0), org.apache.nifi:nifi-framework-cluster (0.6.0) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.6.0)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.6.0 -...

org.apache.nifi.minifi:minifi-framework-core (0.0.1), org.apache.nifi.minifi:minifi-framework-nar (0.0.1) +11 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.6.1)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi.minifi:minifi-framework-core 0.0.1 -...

org.apache.nifi:nifi-cluster-authorization-provider (0.0.1-incubating), org.apache.nifi:nifi-framework-cluster (0.0.1-incubating) +5 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.0.1-incubating)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.0.1-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider...

CVE-2017-15703

Apache NiFi (1.x) is affected by CVE-2017-15703 where an authenticated user with a valid client certificate and without ACL permissions can upload a template containing malicious Java deserialization code, leading to a denial-of-service. The root cause is improper handling of Java deserialization...

org.apache.nifi.minifi:minifi-c2-assembly (>=0.2.0, <=0.3.0), org.apache.nifi.minifi:minifi-c2-provider-nifi-rest (>=0.2.0, <=0.3.0) +17 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (>=0.0.1-incubating, <=1.4.0)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version =0.0.1-incubating, =0.2.0, =0.2.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0-beta, =0.0.1-incubating, =1.0.0-beta, =0.0.1-incubating, =0.0.1-incubating, =0.0.1-incubating, =0.0.1-incubating, =1.2.0, =1.4.0 and more Source cves:...