RSS   Vulnerabilities for 'Ambari'   RSS

2016-05-18
 
CVE-2016-0731

 

 
The File Browser View in Apache Ambari before 2.2.1 allows remote authenticated administrators to read arbitrary files via a file: URL in the WebHDFS URL configuration.

 
 
CVE-2016-0707

 

 
The agent in Apache Ambari before 2.1.2 uses weak permissions for the (1) /var/lib/ambari-agent/data and (2) /var/lib/ambari-agent/keys directories, which allows local users to obtain sensitive information by reading files in the directories.

 
2015-11-08
 
CVE-2015-4940

 

 
Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, stores a cleartext BigSheets password in a configuration file, which allows local users to obtain sensitive information by reading this file.

 
 
CVE-2015-4928

 

 
Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allows physically proximate attackers to obtain sensitive information by reading password fields.

 
2015-11-02
 
CVE-2015-5210

 

 
Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter.

 
 
CVE-2015-3270

 

 
Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors, possibly related to changing passwords.

 
 
CVE-2015-3186

 

 
Cross-site scripting (XSS) vulnerability in Apache Ambari before 2.1.0 allows remote authenticated cluster operator users to inject arbitrary web script or HTML via the note field in a configuration change.

 
 
CVE-2015-1775

 

 
Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.

 

 >>> Vendor: Apache 128 Products
Http server
Tomcat
Jserv
Mod python
Cocoon
Xerces-c++
James
Mod auth radius
Spamassassin
Coyote http connector
Mod imap
Struts
Derby
Geronimo
Log4net
Open for business project
Opentaps
Tomcat jk web server connector
Apache test
Mod perl
AXIS
Myfaces tomahawk
Jakarta slide
Apache webserver
Mod jk
Roller
Apr-util
Jackrabbit
Apache http server
Tiles
Portable runtime
APR
SOLR
QPID
Couchdb
Axis2
Activemq
Myfaces
CXF
Traffic server
Subversion
Archiva
Shiro
Mod fcgid
Libcloud
Continuum
Httpclient
Rampart/c
Wicket
Apache commons daemon
Http server2.0a1
Http server2.0a2
Http server2.0a3
Http server2.0a4
Http server2.0a5
Http server2.0a6
Http server2.0a7
Http server2.0a8
Http server2.0a9
Hadoop
Openoffice.org
Commons-compress
Org.apache.sling.servlets.post
POI
Cloudstack
Commons-httpclient
Commons fileupload
RAVE
Maven
Openjpa
Struts2-showcase
Xml security for c++
Xml security for java
Camel
Shindig
Sling auth core component
Sling
Mod dontdothat
Mod dav svn
Cordova
Xalan-java
Zookeeper
Syncope
Harmony
Hbase
Httpasyncclient
Ofbiz
Openoffice
Apache axis2/c
Wss4j
Mod auth mellon
HIVE
Xml security
Santuario xml security for java
Standard taglibs
Mod-gnutls
Batik
Xerces-c
Cassandra
FLEX
See all Products for Vendor Apache


Copyright 2017, cxsecurity.com