Archive
19 November 2019
Vulnerabilities first published on this day (UTC), newest first.
3 results · Clear filters · Feed
-
Medium 5.3
Apache NiFi process group information disclosure
When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user…
-
Medium 6.5
Apache NiFi information disclosure by XXE
The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions o…
-
Medium 4.4
cookie-signature Timing Attack
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.