Microsoft Windows Elevation of Privilege (MS16-111: CVE-2016-3373)

An elevation of privilege vulnerability exists in Microsoft Windows. A malicious user can bypass a security check in Windows to read and write registry hive files under a hidden registry hive which could enable an elevation of privilege. Successful exploitation could allow an attacker to run...

CVE-2016-0760

Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the 1 reflect, 2 reflect2, or 3 javamethod Hive builtin functions...

CVE-2016-0760

Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the 1 reflect, 2 reflect2, or 3 javamethod Hive builtin functions...

PT-2016-4406

Name of the Vulnerable Software and Affected Versions Apache Sentry versions prior to 1.7.0 Description The issue allows remote authenticated users to execute arbitrary code via the 1 reflect, 2 reflect2, or 3 java method Hive builtin functions. Recommendations For versions prior to 1.7.0, update...

Hive Built-in Function Arbitrary Code Execution Vulnerability

hive is a data warehouse tool based on Hadoop that maps structured data files to a single database table and provides simple sql query functionality that can convert sql statements into MapReduce tasks to run. Arbitrary code execution vulnerabilities exist in the 'reflect', 'reflect2' and...

FreeBSD : hive -- authorization logic vulnerability (a5c204b5-4153-11e6-8dfe-002590263bf5)

Sushanth Sowmyan reports : Some partition-level operations exist that do not explicitly also authorize privileges of the parent table. This can lead to issues when the parent table would have denied the operation, but no denial occurs because the partition-level privilege is not checked by the...

with HIVE - Dynamic Code Loading, External URLs, Possible privilege escalation vulnerabilities

HackApp vulnerability scanner discovered that application with HIVE published at the 'play' market has multiple vulnerabilities...

Apache Hive authorization framework security bypass vulnerability

Apache Hive is a suite of Hadoop-based data warehouse software. The software provides a data integration approach and a high-level query language to support large-scale data analysis on Hadoop. authorization is one of the authorization framework. Apache Hive's authorization framework has a securi...

Authorization

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations...

CVE-2015-7521

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations...

CVE-2015-7521

The CVE-2015-7521 entry concerns Apache Hive (versions 1.0.0–1.2.1) run on clusters protected by Ranger and SqlStdHiveAuthorization. It describes an authorization bypass where partition-level operations can grant access that should be denied at the parent table level, effectively bypassing parent...

CVE-2015-7521

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations...

CVE-2015-7521: Improper Authentication

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations...

PT-2016-3802

Name of the Vulnerable Software and Affected Versions Apache Hive versions 1.0.0 through 1.2.1 Description The issue concerns the authorization framework, allowing attackers to bypass intended access restrictions on parent tables via partition-level operations, in clusters protected by Ranger and...

Authentication flaw

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authenticatio...

CVE-2015-1772

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authenticatio...

CVE-2015-1772

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authenticatio...

CVE-2015-1772: Improper Authentication

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authenticatio...

PT-2015-5437

Name of the Vulnerable Software and Affected Versions Apache Hive versions prior to 1.0.1 Apache Hive versions 1.1.x prior to 1.1.1 IBM InfoSphere BigInsights versions 3.0, 3.0.0.1, and 3.0.0.2 Description The issue concerns the LDAP implementation in HiveServer2, which improperly handles simple...

Security Misconfiguration Vulnerability in the AWS SDK for PHP

SECURITY FIX: This release addresses a security issue associated with CVE-2015-5723, specifically, fixes improper default directory umask behavior that could potentially allow unauthorized modifications of PHP code. Thanks to @ryan-lane for the initial report. Aws\Ec2 - Added support for...