The vulnerability of the Apache SeaTunnel data processing software lies in its authentication procedures’ deficiencies, which allow attackers to gain unauthorized access to protected information.

The vulnerability of the Apache SeaTunnel data processing platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Apache RocketMQ Information Disclosure Vulnerability

Apache RocketMQ is the United States Apache Apache Foundation of a lightweight data processing platform and messaging engine. An information disclosure vulnerability exists in Apache RocketMQ, which can be exploited by an attacker to obtain an administrator's account and password via a specific...

Cybercriminals Targeting Apache NiFi Instances for Cryptocurrency Mining

A financially motivated threat actor is actively scouring the internet for unprotected Apache NiFi instances to covertly install a cryptocurrency miner and facilitate lateral movement. The findings come from the SANS Internet Storm Center ISC, which detected a spike in HTTP requests for "/nifi" o...

Apache RocketMQ Command Execution Vulnerability

Apache RocketMQ is the United States Apache Apache Foundation of a lightweight data processing platform and messaging engine. A command execution vulnerability exists in Apache RocketMQ 5.1.0 and prior versions, which stems from an application failing to properly filter special elements of...

CVE-2022-39273

FlyteAdmin's CVE-2022-39273 describes a vulnerability in the default OAuth2 authorization server configuration. When ExternalAuthorizationServer is not specified, the default clientid hashes and a hardcoded hashed password in Flyte Admin (and propagated to the Propeller configmap in Helm charts) ...

CVE-2022-39273 Default OAuth Authorization Server secret in FlyteAdmin

FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet. In an effort to make enabling authentication easier for Flyte administrators, the...

The vulnerability of the JDBC driver of the Kylin data processing platform allows a hacker to execute arbitrary code.

The vulnerability of the JDBC driver of the Kylin data processing platform is related to the disclosure of information in the error data area. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Apache Flink suffers from an arbitrary file read vulnerability (CNVD-2021-03406)

Apache Flink is efficient and distributed general purpose data processing platform. Apache Flink suffers from an arbitrary file read vulnerability that can be exploited by an attacker to obtain sensitive information...

The vulnerabilities of the Caching components, CacheStore, and the software platform for data processing in Oracle Coherence allow a hacker to gain full control over the application.

The vulnerability of the Caching, CacheStore, and Invocation components of the Oracle Coherence data processing software platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain full control over the application through the IIOP an...