305 matches found
CVE-2017-12625
Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...
CVE-2016-6815
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...
CVE-2016-6815
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...
Default credentials
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...
CVE-2016-6815
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role...
CVE-2016-6815
The CVE-2016-6815 issue affects Apache Ranger prior to 0.6.2, where users with the keyadmin role can change the password for users with the admin role, enabling local privilege escalation.
The vulnerability of the mechanism for implementing compatibility policies for the Apache Ranger software platform allows a violator to induce unpredictable behavior from the program.
The vulnerability of the compatibility policy implementation mechanism in the Apache Ranger software platform arises from the disregard of symbols located after the "" symbol. Exploiting this vulnerability can allow a remote attacker to cause unpredictable behavior in the program...
Apache Ranger Cross-Site Scripting Vulnerability
Apache Ranger is the Apache Software Foundation's architecture for implementing comprehensive security measures for Hadoop clusters, providing centralized security policy management for core enterprise security requirements such as authorization, billing, and data protection. A cross-site scripti...
Escalation Of Privileges
Ranger unixusersync is vulnerable to privilege escalation attacks. If a user is deleted, it is not removed from Ranger's database. This means that if another user is created with the name username that was deleted, that user will automatically have the privileges of the previous user...
CVE-2016-8746
Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true...
CVE-2016-8751
Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies...
CVE-2017-7676
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character - like mytest, test.txt. This can result in unintended behavior...
CVE-2016-8751
Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies...
Design/Logic Flaw
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character - like mytest, test.txt. This can result in unintended behavior...
CVE-2017-7676
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character - like mytest, test.txt. This can result in unintended behavior...
CVE-2016-8746
Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true...
CVE-2017-7677
In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table...
Cross site scripting
Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies...