| CVE-2023-22832 |
The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references
|
Not rated
|
Feb 10, 2023 |
| CVE-2022-33140 |
The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not…
|
Not rated
|
Jun 15, 2022 |
| CVE-2022-29265 |
Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default…
|
Not rated
|
Apr 30, 2022 |
| CVE-2022-26850 |
When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers…
|
Not rated
|
Apr 6, 2022 |
| CVE-2021-44145 |
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which,…
|
Not rated
|
Dec 17, 2021 |
| CVE-2020-1933 |
A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0
|
Not rated
|
Jan 28, 2020 |
| CVE-2020-1928 |
An information disclosure vulnerability was found in Apache NiFi 1.10.0
|
Not rated
|
Jan 28, 2020 |
| CVE-2018-17195 |
The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing +…
|
Not rated
|
Dec 19, 2018 |
| CVE-2018-17194 |
When a client request to a cluster node was replicated to other nodes in the cluster for verification, the…
|
Not rated
|
Dec 19, 2018 |
| CVE-2018-17193 |
The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization,…
|
Not rated
|
Dec 19, 2018 |
| CVE-2018-17192 |
The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing…
|
Not rated
|
Dec 19, 2018 |
| CVE-2018-1310 |
Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability
|
Not rated
|
May 23, 2018 |
| CVE-2018-1309 |
Apache NiFi External XML Entity issue in SplitXML processor
|
Not rated
|
May 23, 2018 |
| CVE-2017-15703 |
Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained…
|
Not rated
|
Jan 25, 2018 |
| CVE-2017-15697 |
A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could…
|
Not rated
|
Jan 23, 2018 |
| CVE-2017-12632 |
A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server
|
Not rated
|
Jan 23, 2018 |
| CVE-2017-5636 |
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization…
|
Not rated
|
Oct 19, 2017 |
| CVE-2017-5635 |
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to…
|
Not rated
|
Oct 19, 2017 |
| CVE-2016-8748 |
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection…
|
Not rated
|
Oct 19, 2017 |
| CVE-2017-12623 |
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML…
|
Not rated
|
Oct 10, 2017 |
| CVE-2017-7667 |
Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow…
|
Not rated
|
Jun 12, 2017 |
| CVE-2017-7665 |
In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been…
|
Not rated
|
Jun 12, 2017 |