Design/Logic Flaw

An issue was discovered in Ignite Realtime Spark 2.8.3 and the ROAR plugin for it on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the NTLM hashes of the user are sent with the HTTP request. Th...

CVE-2020-12772

CVE-2020-12772 affects Ignite Realtime Spark 2.8.3 on Windows and the ROAR plugin. A chat message can embed an IMG tag whose SRC points to an external host’s IP, causing the user’s NTLM hashes to be sent with the HTTP request when the host is accessed. This enables an attacker to collect hashes, ...

CVE-2020-12772

An issue was discovered in Ignite Realtime Spark 2.8.3 and the ROAR plugin for it on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the NTLM hashes of the user are sent with the HTTP request. Th...

Security Bulletin: A denial of service vulnerability in IBM WebSphere Liberty Profile affects IBM Spectrum Conductor and IBM Spectrum Conductor with Spark

Summary There is a denial of server vulnerability in IBM WebSphere Liberty Profile used by IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0, IBM Spectrum Conductor 2.3.0, and IBM Spectrum Conductor with Spark 2.2.1. IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0, IBM Spectru...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Conductor and IBM Spectrum Conductor with Spark

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0, IBM Spectrum Conductor 2.3.0, and IBM Spectrum Conductor with Spark 2.2.1. IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0, IBM...

CVE-2019-12370

The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12370

The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

Cross site scripting

The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12370

The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12370

The provided connected records confirm that CVE-2019-12370 affects the Spark Android app up to version 2.0.2, enabling XSS via an event attribute and arbitrary file loading through a src attribute when READ_EXTERNAL_STORAGE permission is granted. The root cause and exact vulnerable component are ...

GHSA-QXF4-CHVG-4R8R vulnerabilities

Vulnerabilities for packages: spark-compat...

Apache Spark Unauthenticated Remote Code Execution (CVE-2018-11770)

A remote code execution vulnerability exists in Apache Spark. Successful exploitation of this vulnerability could result in arbitrary code execution...

CVE-2020-1938 vulnerabilities

Vulnerabilities for packages: spark-compat...

The vulnerability of the PySpark interface of the Apache Spark framework, which allows attackers to escalate their privileges

The vulnerability of the PySpark framework of Apache Spark is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Apache Spark framework, related to deficiencies in the authentication process, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Apache Spark framework is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

GHSA-HH3J-X4MC-G48R vulnerabilities

Vulnerabilities for packages: spark-compat...

GHSA-9XCJ-C8CR-8C3C vulnerabilities

Vulnerabilities for packages: spark-compat...

CVE-2019-12418 vulnerabilities

Vulnerabilities for packages: spark-compat...

CVE-2019-17563 vulnerabilities

Vulnerabilities for packages: spark-compat...

Security Bulletin: Multiple Vulnerabilities in Apache Spark affects IBM Watson Studio Local

Summary Security Bulletin: Multiple Vulnerabilities in Apache Spark affects IBM Watson Studio Local Vulnerability Details CVEID: CVE-2018-11804 DESCRIPTION: Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. ...