Apache Software Foundation NiFi

CPE Details

Apache Software Foundation NiFi
-
2023-06-21
00h04 +00:00
2023-06-21
11h33 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:apache:nifi:-:*:*:*:*:*:*:*

Informations

Vendor

apache

Product

nifi

Version

-

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2018-1309 2018-05-23 14h00 +00:00 Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
9.8
Critical
CVE-2018-1310 2018-05-23 14h00 +00:00 Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for more information. The fix to upgrade the activemq-client library to 5.15.3 was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
7.5
High
CVE-2017-12632 2018-01-23 22h00 +00:00 A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
7.5
High
CVE-2016-8748 2017-10-19 20h00 +00:00 In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
5.4
Medium
CVE-2017-7665 2017-06-12 14h00 +00:00 In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient.
6.1
Medium
CVE-2017-7667 2017-06-12 14h00 +00:00 Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin.
7.5
High