com.amazon.emr:emr-dynamodb-hadoop (>=4.2.0 <=4.3.0), com.amazon.emr:emr-dynamodb-tools (=4.2.0) +150 more potentially affected by CVE-2016-3086 via org.apache.hadoop:hadoop-yarn-server-nodemanager (>=2.7.0 <=2.7.2)

org.apache.hadoop:hadoop-yarn-server-nodemanager MAVEN version =2.7.0, =4.2.0, =1.0.4, =1.0.4, =1.2.0, =1.0.2, =1.0.2, =1.2.1, =10.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1, =1.2.0 - com.intropro.prairie:hbase-unit =1.2.0 and more Source cves: CVE-2016-3086 Source advisory: OSV:GHSA-895M-WW55-5...

com.github.mlk:assortmentofjunitrules (=1.0), io.cdap.cdap:cdap-data-streams3_2.12 (>=6.5.0 <=6.8.3) +14 more potentially affected by CVE-2016-3086 via org.apache.hadoop:hadoop-yarn-server-nodemanager (>=2.6.0 <=2.6.4)

org.apache.hadoop:hadoop-yarn-server-nodemanager MAVEN version =2.6.0, =6.5.0, =1.8.0, =2.6.0, =1.0.0, =1.2.1, =1.2.1, =1.0.0, =1.0.0, =1.3.5 and more Source cves: CVE-2016-3086 Source advisory: OSV:GHSA-895M-WW55-59VW...

Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications...

GHSA-MF7C-35MQ-75PJ Insecure Inherited Permissions in Apache Hadoop

In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user...

com.mozu:mozu-api-jobs (>=1.0.13 <=1.0.23), gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin (>=0.0.1 <=0.0.8) +25 more potentially affected by CVE-2018-1229 via org.springframework.batch:spring-batch-admin-manager (>=1.3.0.RELEASE <=1.3.1.RELEASE)

org.springframework.batch:spring-batch-admin-manager MAVEN version =1.3.0.RELEASE, =1.0.13, =0.0.1, =1.3.1.RELEASE, =1.6.0.RELEASE, =1.0.0.RELEASE, =1.0.0.RELEASE, =1.1.0.RELEASE, =1.0.0.RELEASE, =1.0.0.RELEASE, =1.0.0.RELEASE, =1.1.0.RELEASE, =1.7.3.RELEASE -...

brainhance (=0.0.1), crystal4d (>=0.0.4 <=0.1.2) +3 more potentially affected by CVE-2021-29607 via tensorflow-gpu (>=2.4.0 <=2.4.1)

tensorflow-gpu PYPI version =2.4.0, =0.0.4, =1.1.1, =1.0.0, =1.0.1 - tf-yarn-gpu =0.6.3 Source cves: CVE-2021-29607 Source advisory: OSV:GHSA-GV26-JPJ9-C8GQ...

@atto-byte/ui (=1.0.4), @cessair/building (=1.0.0) +129 more potentially affected by CVE-2019-15608 via yarn (>=0.15.1 <=1.17.3)

yarn NPM version =0.15.1, =1.0.0, =1.0.0, =1.9.9, =1.0.0, =1.0.21, =1.6.6-0, =8.3.8, =0.1.0, =0.1.0, =0.1.14 and more Source cves: CVE-2019-15608 Source advisory: OSV:GHSA-HJXC-462X-X77J...

TOCTOU Race Condition in Yarn

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0...

GHSA-HJXC-462X-X77J TOCTOU Race Condition in Yarn

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0...

Path Traversal in Yarn

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package...

GHSA-8MFC-V7WV-P62G Path Traversal in Yarn

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package...

Apache Hadoop Yarn RPC Unauthorized Command Execution Vulnerability

Apache Hadoop is a distributed infrastructure. Apache Hadoop Yarn RPC Unauthorized Command Execution vulnerability can be exploited by attackers to gain control of the server...

brainhance (=0.0.1), crystal4d (>=0.0.4 <=0.1.2) +4 more potentially affected by CVE-2021-37635 via tensorflow-gpu (>=2.4.0 <=2.4.2)

tensorflow-gpu PYPI version =2.4.0, =0.0.4, =1.1.1, =0.1.0.dev98, =1.0.0, =1.0.1 - tf-yarn-gpu =0.6.3 Source cves: CVE-2021-37635 Source advisory: OSV:GHSA-CGFM-62J4-V4RF...

brainhance (=0.0.1), crystal4d (>=0.0.4 <=0.1.2) +4 more potentially affected by CVE-2021-37636 via tensorflow-gpu (>=2.4.0 <=2.4.2)

tensorflow-gpu PYPI version =2.4.0, =0.0.4, =1.1.1, =0.1.0.dev98, =1.0.0, =1.0.1 - tf-yarn-gpu =0.6.3 Source cves: CVE-2021-37636 Source advisory: OSV:GHSA-HP4C-X6R7-6555...

brainhance (=0.0.1), crystal4d (>=0.0.4 <=0.1.2) +4 more potentially affected by CVE-2021-37637 via tensorflow-gpu (>=2.4.0 <=2.4.2)

tensorflow-gpu PYPI version =2.4.0, =0.0.4, =1.1.1, =0.1.0.dev98, =1.0.0, =1.0.1 - tf-yarn-gpu =0.6.3 Source cves: CVE-2021-37637 Source advisory: OSV:GHSA-C9QF-R67M-P7CG...

brainhance (=0.0.1), crystal4d (>=0.0.4 <=0.1.2) +4 more potentially affected by CVE-2021-37638 via tensorflow-gpu (>=2.4.0 <=2.4.2)

tensorflow-gpu PYPI version =2.4.0, =0.0.4, =1.1.1, =0.1.0.dev98, =1.0.0, =1.0.1 - tf-yarn-gpu =0.6.3 Source cves: CVE-2021-37638 Source advisory: OSV:GHSA-HWR7-8GXX-FJ5P...

brainhance (=0.0.1), crystal4d (>=0.0.4 <=0.1.2) +4 more potentially affected by CVE-2021-37639 via tensorflow-gpu (>=2.4.0 <=2.4.2)

tensorflow-gpu PYPI version =2.4.0, =0.0.4, =1.1.1, =0.1.0.dev98, =1.0.0, =1.0.1 - tf-yarn-gpu =0.6.3 Source cves: CVE-2021-37639 Source advisory: OSV:GHSA-GH6X-4WHR-2QV4...

brainhance (=0.0.1), crystal4d (>=0.0.4 <=0.1.2) +4 more potentially affected by CVE-2021-37640 via tensorflow-gpu (>=2.4.0 <=2.4.2)

tensorflow-gpu PYPI version =2.4.0, =0.0.4, =1.1.1, =0.1.0.dev98, =1.0.0, =1.0.1 - tf-yarn-gpu =0.6.3 Source cves: CVE-2021-37640 Source advisory: OSV:GHSA-95XM-G58G-3P88...

brainhance (=0.0.1), crystal4d (>=0.0.4 <=0.1.2) +4 more potentially affected by CVE-2021-37641 via tensorflow-gpu (>=2.4.0 <=2.4.2)

tensorflow-gpu PYPI version =2.4.0, =0.0.4, =1.1.1, =0.1.0.dev98, =1.0.0, =1.0.1 - tf-yarn-gpu =0.6.3 Source cves: CVE-2021-37641 Source advisory: OSV:GHSA-9C8H-VVRJ-W2P8...

brainhance (=0.0.1), crystal4d (>=0.0.4 <=0.1.2) +4 more potentially affected by CVE-2021-37642 via tensorflow-gpu (>=2.4.0 <=2.4.2)

tensorflow-gpu PYPI version =2.4.0, =0.0.4, =1.1.1, =0.1.0.dev98, =1.0.0, =1.0.1 - tf-yarn-gpu =0.6.3 Source cves: CVE-2021-37642 Source advisory: OSV:GHSA-CH4F-829C-V5PW...