Skip to content
OpenAdvisories

Package · Maven

org.apache.ranger:ranger

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-28672 Public exploit

    Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.

    Apache Software Foundation Apache Ranger org.apache.ranger:ranger Maven
  • Critical 9.1
    CVE-2024-45479

    Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost

    SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.

    Apache Software Foundation Apache Ranger org.apache.ranger:ranger Maven
  • Critical 9.8
    CVE-2017-7676

    Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character

    Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended behavior.

    Apache Software Foundation Apache Ranger org.apache.ranger:ranger Maven
  • Critical 9.8
    CVE-2016-0733

    The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password

    The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.

    org.apache.ranger:ranger Maven