Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
apache hadoop vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2022-25168
Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user....
Apache Hadoop
9.8
CVSSv3
CVE-2021-37404
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
Apache Hadoop
9.8
CVSSv3
CVE-2022-26612
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry ma...
Apache Hadoop
Apache Hadoop 3.3.1
Apache Hadoop 3.3.2
9.8
CVSSv3
CVE-2019-17195
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
Connect2id Nimbus Jose+jwt
Apache Hadoop 3.2.1
Oracle Solaris Cluster 4.0
Oracle Weblogic Server 12.2.1.3.0
Oracle Weblogic Server 12.2.1.4.0
Oracle Peoplesoft Enterprise Peopletools 8.58
Oracle Enterprise Manager Base Platform 13.4.0.0
Oracle Primavera Gateway 19.12.0
Oracle Data Integrator 12.2.1.4.0
Oracle Peoplesoft Enterprise Peopletools 8.59
Oracle Primavera Gateway
Oracle Communications Pricing Design Center 12.0.0.3.0
Oracle Jd Edwards Enterpriseone Tools
Oracle Policy Automation
Oracle Communications Cloud Native Core Security Edge Protection Proxy 1.7.0
Oracle Insurance Policy Administration
Oracle Healthcare Data Repository 8.1.0
Oracle Jd Edwards Enterpriseone Orchestrator
9.8
CVSSv3
CVE-2017-15718
The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.
Apache Hadoop 2.7.3
Apache Hadoop 2.7.4
9.8
CVSSv3
CVE-2012-4449
Apache Hadoop prior to 0.23.4, 1.x prior to 1.0.4, and 2.x prior to 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent malicious users to crack secret keys via a brute-force attack.
Apache Hadoop 1.0.3
Apache Hadoop 1.0.0
Apache Hadoop 2.0.0
Apache Hadoop 1.0.2
Apache Hadoop 1.0.1
Apache Hadoop 2.0.2
Apache Hadoop 2.0.1
Apache Hadoop
9.8
CVSSv3
CVE-2016-3086
The YARN NodeManager in Apache Hadoop 2.6.x prior to 2.6.5 and 2.7.x prior to 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.
Apache Hadoop 2.6.0
Apache Hadoop 2.6.2
Apache Hadoop 2.7.0
Apache Hadoop 2.6.3
Apache Hadoop 2.6.4
Apache Hadoop 2.7.2
Apache Hadoop 2.7.1
Apache Hadoop 2.6.1
8.8
CVSSv3
CVE-2021-25642
ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache...
Apache Hadoop
1 Github repository
8.8
CVSSv3
CVE-2021-33036
In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
Apache Hadoop 3.0.0
Apache Hadoop
8.8
CVSSv3
CVE-2020-9492
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
Apache Hadoop
Apache Solr 8.6.0
Apache Solr 8.6.2
Oracle Financial Services Crime And Compliance Management Studio 8.0.8.2.0
Oracle Financial Services Crime And Compliance Management Studio 8.0.8.3.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
type confusion
IMAP
CVE-2024-36103
CVE-2024-28995
CVE-2024-37325
CVE-2024-30078
CVE-2024-30082
SQL injection
CVE-2024-30052
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
NEXT »