411 matches found
CVE-2016-2174
SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime...
CVE-2016-2174: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime...
PT-2016-5047
Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 0.5.3 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved by exploiting the eventTime parameter in the /service/plugins/policies/eventTime API...
Apache Ranger SQL Injection Vulnerability
Apache Ranger is a set of architectures for implementing comprehensive security measures for Hadoop clusters, providing centralized security policy management for core enterprise security requirements such as authorization, billing and data protection. Apache Ranger suffers from a SQL injection...
CVE-2016-0733
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...
CVE-2016-0733
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...
CVE-2015-5167
The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API...
Authentication flaw
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...
Design/Logic Flaw
The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API...
CVE-2016-0733
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...
CVE-2015-5167
The CVE-2015-5167 entry concerns Apache Ranger’s Policy Admin Tool. The vulnerability allows remote authenticated users to bypass intended access restrictions via the REST API in Ranger versions prior to 0.5.1. Affected component: Policy Admin Tool; root cause described as an access-control bypas...
CVE-2016-0733
The CVE covers Apache Ranger’s Admin UI prior to 0.5.1, where authentication requests lacking a password are mishandled. The root cause is improper handling of credentials in the Admin UI authentication logic, allowing remote attackers to bypass login by leveraging a known valid username. Reporte...
CVE-2015-5167
The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API...
CVE-2016-0733: Improper Authentication
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...
PT-2016-4392
Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 0.5.1 Description The issue concerns the Admin UI in Apache Ranger, where it fails to properly handle authentication requests that lack a password. This allows remote attackers to bypass authentication if they...
CVE-2015-5167: Undefined Security Weakness
The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API...
PT-2016-3670
Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 0.5.1 Description The issue allows remote authenticated users to bypass intended access restrictions. This is achieved via the REST API. Recommendations For versions prior to 0.5.1, update to version 0.5.1 or...
CVE-2016-0735
Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy...