Deserialization of Untrusted Data in Apache Storm

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...

Unauthorized File Access

Apache Storm Core is vulnerable to unauthorized file read. It exposes HTTP-accessible endpoints on the host's file system, allowing an attacker to read/search log files on the host...

CVE-2019-0202

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...

CVE-2019-0202

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...

CVE-2018-11779

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...

CVE-2018-11779

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...

Security feature bypass

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...

Code injection

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...

Apache Storm Information Disclosure Vulnerability

Apache Storm is the United States Apache Apache Software Foundation, a set of open source distributed real-time computing system using Clojure concurrent programming language development. An information disclosure vulnerability exists in Apache Storm versions 0.9.1-incubating through 1.2.2. The...

CVE-2018-11779

Technical details about CVE-2018-11779 are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2018-11779

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...

CVE-2019-0202

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...

CVE-2019-0202

CVE-2019-0202 affects Apache Storm Logviewer: versions 0.9.1-incubating through 1.2.2 expose HTTP endpoints that allow reading arbitrary host files via the logviewer. The root cause is an information disclosure vulnerability in the log viewer endpoints, enabling reading files not intended for acc...

Exploit for CVE-2019-14339

CVE-2019-14339 Content Provider URI Injection on Canon PRINT...

Deserialization Of Untrusted Object

Apache Storm UI Deamon is vulnerable to deserialization of untrusted object. When it is using with storm-kafka-client or storm-kafka modules, it does not filter the input of untrusted bytes before deserialization, allowing an attacker to provide malicious bytes to abuse the logic of the applicati...

Apache Storm Deserialization Vulnerability

Apache Storm is the United States Apache Apache Software Foundation, a set of open source distributed real-time computing system using Clojure concurrent programming language development. A deserialization vulnerability exists in Apache Storm versions 1.1.0 through 1.2.2. The vulnerability stems...

CVE-2019-0046

A vulnerability in the pfe-chassisd Chassis Manager CMLC daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service DoS to the EX4300 when specific valid broadcast packets create a broadcast storm condition when received on the me0 interface of the EX4300 Series device. A...

Design/Logic Flaw

A vulnerability in the pfe-chassisd Chassis Manager CMLC daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service DoS to the EX4300 when specific valid broadcast packets create a broadcast storm condition when received on the me0 interface of the EX4300 Series device. A...

CVE-2019-0046

Summary: CVE-2019-0046 affects Juniper Networks Junos OS on EX4300 Series, via the pfe-chassisd Chassis Manager (CMLC) daemon. The vulnerability allows an attacker to cause a Denial of Service by sending specific valid broadcast packets that trigger a broadcast storm on the me0 interface, requiri...

The vulnerability of the “GCSvc.exe” service in the information protection system against unauthorized access by the Storm NT security system allows a intruder to cause a service failure.

The vulnerability of the “GCSvc.exe” service in the information protection system against unauthorized access, managed by the Storm NT security system, is related to incorrect processing of input data. Exploiting this vulnerability could allow an intruder, operating locally, to cause a service...