CVE-2017-7678

In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. This data, which could contain a script,...

CVE-2017-7678

CVE-2017-7678 affects Apache Spark up to version 2.2.0, where the web UI may reflect user-supplied data (including MHTML) back to the user. The root cause is improper validation of input by the Spark web UI, allowing an attacker to lure a user into a link pointing to a shared Spark cluster and tr...

CVE-2017-7678: Improper Neutralization of Input During Web Page Generation

In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. This data, which could contain a script,...

Cisco Spark - Certificates or keys found, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Cisco Spark published at the 'play' market has multiple vulnerabilities...

Remote Code Execution (RCE) Via Unsafe Deserialization

apache-spark is vulnerable to remote code execution RCE through unsafe deserialization. A malicious user can pass an object through the port of the system that when deserialized can cause arbitrary code to be executed...

CVE-2017-3825

A vulnerability in the ICMP ingress packet processing of Cisco TelePresence Collaboration Endpoint CE Software could allow an unauthenticated, remote attacker to cause the TelePresence endpoint to reload unexpectedly, resulting in a denial of service DoS condition. The vulnerability is due to...

CVE-2017-3825: Improper Input Validation

A vulnerability in the ICMP ingress packet processing of Cisco TelePresence Collaboration Endpoint CE Software could allow an unauthenticated, remote attacker to cause the TelePresence endpoint to reload unexpectedly, resulting in a denial of service DoS condition. The vulnerability is due to...

Cross-site Scripting (XSS)

spark-core is vulnerable to cross-site scripting XSS attacks. The attacks are possible because it does not use the stripXSS function in the pages calling request.getParameter in UIUtils...

Spark: Directory traversal vulnerability in version 2.5

A path traversal issue was found in Spark version 2.5 and potentially earlier versions. The vulnerability resides in the functionality to serve static files where there's no protection against directory traversal attacks. This could allow attackers access to private files including sensitive data...

IBM Development Package for Apache Spark Denial of Service Vulnerability

IBM Development Package for Apache Spark is a software development kit. A denial of service vulnerability exists in IBM Development Package for Apache Spark, which can be exploited to launch a denial of service attack. In addition, the Apache Development Package for Apache Spark is vulnerable to ...

Information Disclosure

spark-core is vulnerable to information disclosure. The vulnerability is possible due to a flaw in the security filter not performing authentication at the application level but instead at the roof of the UI. Therefore, the data and application in the SHS can be accessed through the REST API by a...

CVE-2016-9177

A path traversal issue was found in Spark version 2.5 and potentially earlier versions. The vulnerability resides in the functionality to serve static files where there's no protection against directory traversal attacks. This could allow attackers access to private files including sensitive data...

Spark Arbitrary File Read Vulnerability

Spark is a miniature Java Web framework designed to let you create a Java Web application with minimal effort. An arbitrary file read vulnerability exists in Spark version 2.5, which can be exploited by an attacker to gain access to sensitive system information and launch further attacks...

Spark Directory Traversal Vulnerability

Spark is a set of lightweight framework for creating Web applications. A directory traversal vulnerability exists in Spark version 2.5. A remote attacker can leverage the directory traversal character in the URI '... /' in a URI to read arbitrary files...

CVE-2016-9177

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2016-9177

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

Directory traversal

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2016-9177

CVE-2016-9177 affects Spark 2.5 (path traversal vulnerability in static file serving). The root cause is directory traversal protection not preventing a .. in the URI, allowing an attacker to read arbitrary server files. Documented impact includes potential exposure of sensitive data. Mitigation ...

CVE-2016-9177

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2016-9177: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the URI...