craftcruises.com XSS vulnerability

Open Bug Bounty ID: OBB-626679 Description| Value ---|--- Affected Website:| craftcruises.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

DAG Client Leakage

tez-api is vulnerable to DAG client Leakage. The vulnerability exists because when terminating the connection to the YARN cluster, it does not shutdown Prewarm DAG client, leading to the leakage of DAG client...

Hadoop YARN ResourceManager Unauthenticated Command Execution

This module uses Hadoop's standard ResourceManager REST API to execute arbitrary commands on an unsecured Hadoop server. Hadoop administrators should enable Kerberos authentication for these endpoints by changing the 'hadoop.security.authentication' setting in 'core-site.xml' from 'simple' the...

Apache Hadoop elevation of privilege vulnerability (CNVD-2018-10426)

Apache Hadoop is the U.S. Apache Apache Software Foundation's set of open source distributed systems infrastructure, it can be distributed processing of large amounts of data, and has high reliability, high scalability, high fault tolerance and other characteristics. Apache Hadoop 2.2.0 to 2.7.3...

Apache Hadoop 2.7.3 Privilege Escalation Vulnerability

Exploit for multiple platform in category remote exploits CVE-2016-6811: Apache Hadoop Privilege escalation vulnerability Severity: Critical Vendor: The Apache Software Foundation Versions Affected: All the Apache Hadoop versions from 2.2.0 to 2.7.3 Description: A user who can escalate to yarn us...

File Permission Manipulation Via Symlink Attack

hadoop-common-yarn is vulnerable to file permission manipulation. Using a symlink attack in a public tar archive, attackers can change the permissions on files to be world-readable...

Information Disclosure

hadoop-yarn-server-nodemanager is vulnerable to password leakage. The fix for CVE-2016-3086 was incomplete so passwords from the credential store provider are still leaked through the NodeManager...

Apache Hadoop YARN NodeManager Password Leak Vulnerability

In Apache Hadoop 2.7.3 and 2.7.4, the security fix for CVE-2016-3086 is incomplete. The YARN NodeManager can leak the password for credential store provider used by the NodeManager to YARN Applications. CVE-2017-15718: Apache Hadoop YARN NodeManager vulnerability Severity: Important Vendor: The...

Apache Hadoop YARN NodeManager Password Disclosure Vulnerability

Apache Hadoop is a set of open source distributed system infrastructure of the Apache Apache Software Foundation of the United States, which is capable of distributed processing of large amounts of data, and has high reliability, high scalability, high fault tolerance, etc. YARN NodeManager is on...

Apache Hadoop 2.7.3 - 2.7.4 YARN NodeManager Information Disclosure Vulnerability

Apache Hadoop is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:hadoop"...

Memory corruption

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

CVE-2017-15718

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

CVE-2017-15718

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

CVE-2017-15718

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

CVE-2017-15718

CVE-2017-15718 affects Apache Hadoop, specifically the YARN NodeManager in Hadoop 2.7.3 and 2.7.4, which can leak the password for the NodeManager credential store provider to YARN Applications. The vulnerability is an information disclosure in the NodeManager component that could expose credenti...

allfreeknitting.com XSS vulnerability

Open Bug Bounty ID: OBB-429502 Description| Value ---|--- Affected Website:| allfreeknitting.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

Apache Hadoop Insufficient Access Control Vulnerability

Apache Hadoop is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:hadoop"; i...

Unauthorized Access

Apache Hadoop Mapreduce is vulnerable to unauthorized access. If a file with world-readable access permissions is localized through YARN's localization mechanism, the file will be stored in a world-readable location that can then be accessed by a malicious user...

CVE-2017-3166

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any...

Design/Logic Flaw

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any...