CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter. |
| 08/11/2021 |
| CVE-2021-32481 | MÉDIO6.1 | Cloudera Hue 4.6.0 allows XSS via the type parameter. | 08/11/2021 |
| CVE-2021-29994 | MÉDIO6.1 | Cloudera Hue 4.6.0 allows XSS. | 08/11/2021 |
| CVE-2021-29243 | MÉDIO6.1 | Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS. | 08/11/2021 |
| CVE-2021-3167 | MÉDIO6.5 | In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs. | 15/03/2021 |
| CVE-2020-26936 | ALTO8.8 | Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack. | 26/11/2020 |
| CVE-2019-14449 | MÉDIO5.4 | An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this product. | 26/11/2019 |
| CVE-2019-7319 | ALTO8.3 | An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, SpnegoDjangoBackend, RemoteUserDjangoBackend, SAML2Backend, OpenIDBackend, or OAuthBackend, external users are created with superuser privileges. | 26/11/2019 |
| CVE-2018-20090 | ALTO8.3 | An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. Authenticated users can bypass project permission checks and gain read-write access to any project folder. | 26/11/2019 |
| CVE-2017-7399 | ALTO8.8 | Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users. | 26/11/2019 |
| CVE-2016-9271 | MÉDIO5.4 | Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature. | 26/11/2019 |
| CVE-2018-17860 | ALTO7.2 | Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1. | 26/11/2019 |
| CVE-2015-4457 | MÉDIO5.4 | Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors. | 26/11/2019 |
| CVE-2016-6353 | MÉDIO6.5 | Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the RealTimeGetHandler. | 26/11/2019 |
| CVE-2016-5724 | ALTO7.5 | Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles. | 26/11/2019 |
| CVE-2016-4572 | ALTO8.8 | In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges. | 26/11/2019 |
| CVE-2016-3192 | MÉDIO6.5 | Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files. | 26/11/2019 |