Cross-Site Scripting (XSS)

sentry is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute malicious script in a victim's browser since it does not restrict direct imports of the marked library and renders the marked object without sanitization...

Authorization

In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization and audit mechanisms. Session and query IDs are unique an...

FreeBSD : Gitlab -- Disclosure Vulnerabilities (6eddfa51-fb44-11e9-86e9-001b217b3468)

Gitlab reports : Source branch of a MR could be removed by an unauthorised user Private group members could be listed Disclosure of System Notes via Elasticsearch integration Disclosure of Private Comments via Elasticsearch integration Confirm existence of private repositories Private group...

Gitlab -- Disclosure Vulnerabilities

Gitlab reports: Source branch of a MR could be removed by an unauthorised user Private group members could be listed Disclosure of System Notes via Elasticsearch integration Disclosure of Private Comments via Elasticsearch integration Confirm existence of private repositories Private group...

Zomato: Information Disclosure through Sentry Instance ███████

Hello team I found a bug sensitive information can be used from attackers to perfom attack in youre server I don't know if this in scope so i'm sorry if i'm wrrong withou spending youre time here the steps how i found this bug : 1-Please use burp suite to reproduce the same result 2-i notice you...

Unauthorized Modification

Apache Sentry is vulnerable to unauthorized modification attacks. An unauthorized user could execute ALTER TABLE EXCHANGE PARTITIONS which may allow an attacker to access unauthorized partitioned data of a Sentry protected table and to remove data from a Sentry protected table...

CVE-2017-9325

The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs...

CVE-2017-9325

The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs...

Authorization

The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs...

CVE-2017-9325

Technical details about CVE-2017-9325 are not publicly available in the provided documents. Monitor for updates.

CVE-2017-9325

The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs...

Mail.ru: Blind SSRF [ Sentry Misconfiguraton ]

Researcher found Blind SSRF via Sentry misconfiguration. This report received smaller bounty since server located in dedicated hosting colocation network separated from production servers...

com.huemulsolutions.bigdata:huemul-bigdatagovernance (>=1.1 <=2.1), com.thinkbiganalytics.kylo:kylo-kerberos-test-client (=0.10.0) +3 more potentially affected by CVE-2015-1772 via org.apache.hive:hive-service (=1.1.0)

org.apache.hive:hive-service MAVEN version =1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - com.huemulsolutions.bigdata:huemul-bigdatagovernance =1.1, =2.1 -...

Defending Credentials From Automated Attack Tools

By Danny Wasserman The folks on the Akamai Professional Services team are the people who help implement, configure, and tune the cloud security products that protect our customers' web applications from the daily onslaught of bots blasting login attempts against their websites, mobile apps, and...

Authorization Bypass

hive-exec is vulnerable to an authorization bypass. The library does not provide an authorization fallback if the standard ranger,sql or sentry authorizer is not used, allowing a malicious user to gain unauthorized access to local resources on the HiveServer2 machine...

CVE-2018-11777

In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use...

gVisor Sentry Invalid Access Vulnerability

gVisor Sentry permits access to the renameat syscall. As the sentry is not chrooted, it permits renaming files in the host system. gVisor sentry can call renameat The seccomp sandbox of the gVisor sentry permits access to the renameat syscall:...

Facebook Flaw Allowed Remote Commands

A vulnerability in a Facebook server that could have led to information disclosure and command execution has been patched by the social network. At issue was a Sentry service, which is an open-source error tracking application that helps developers monitor and fix crashes in real time. It’s writt...

Apache Sentry Unauthorized Access Vulnerability

Apache Sentry is an open source component for use in Hadoop clusters. An unauthorized access vulnerability exists in Apache Sentry, which allows remote attackers to submit a special request to delete partitioned data from a table protected by Sentry...

CVE-2018-8028

An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table...