Apache NiFi

Every one of the 55 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Apache NiFi - Information DisclosureCVE-2024-56512Apache Software Foundation · CVSS 2.1 · 3.3% likely

   CWE-638

2. Apache NiFi: Potential Code Injection with Database Services using H2CVE-2023-34468Apache Software Foundation · CVSS 8.8 · 62% likely

   CWE-94

3. Apache NiFi: Improper Neutralization of Input in Parameter Context DescriptionCVE-2024-37389Apache Software Foundation · CVSS 4.6 · 24% likely

   CWE-79

4. A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these hea…CVE-2017-15697Apache Software Foundation · 4.8% likely

   CWE-20

5. Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general…CVE-2018-1309Apache Software Foundation · 4.4% likely

   CWE-611

6. An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal v…CVE-2020-1928Apache Software Foundation · 4.0% likely

   CWE-532

7. In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully cra…CVE-2017-5636Apache Software Foundation · 3.6% likely

   CWE-74

8. In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition c…CVE-2020-9486Apache · 3.6% likely

   CWE-532

9. Improper Neutralization of Command Elements in Shell User Group ProviderCVE-2022-33140Apache Software Foundation · 3.5% likely

   CWE-78

10. In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient.CVE-2017-7665Apache Software Foundation · 3.5% likely

    CWE-79

11. In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather…CVE-2017-5635Apache Software Foundation · 3.3% likely

    CWE-287

12. In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join…CVE-2020-1942Apache · 3.1% likely

    CWE-532

13. Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for mo…CVE-2018-1310Apache Software Foundation · 3.1% likely

    CWE-502

14. In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only w…CVE-2020-9487Apache · 3.0% likely

    CWE-306

15. When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored,…CVE-2018-17194Apache Software Foundation · 3.0% likely

    CWE-20

16. In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpReq…CVE-2020-9491Apache · 2.9% likely

    CWE-327

17. A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitel…CVE-2017-12632Apache Software Foundation · 2.8% likely

    CWE-20

18. A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not app…CVE-2020-1933Apache Software Foundation · 2.8% likely

    CWE-79

19. The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to corr…CVE-2018-17193Apache Software Foundation · 2.8% likely

    CWE-79

20. When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The r…CVE-2019-10083Apache · 2.8% likely

    CWE-200

21. The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results inc…CVE-2018-17192Apache Software Foundation · 2.7% likely

    CWE-1021

22. Improper Restriction of XML External Entity References in Multiple ComponentsCVE-2022-29265Apache Software Foundation · 2.6% likely

    CWE-611

23. Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS ComponentsCVE-2023-34212Apache Software Foundation · 2.4% likely

    CWE-502

24. The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make ex…CVE-2019-10080Apache · 2.3% likely

    CWE-611

25. Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLsCVE-2023-40037Apache Software Foundation · 2.1% likely

    CWE-184

26. In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user suppli…CVE-2016-8748Apache Software Foundation · 2.0% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.