Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 21
Reset filtersApache Ranger has a Code Injection vulnerability
Apache Ranger Vulnerable to Improper Validation of Certificate with Host Mismatch
Apache Ranger UI vulnerable to Server Side Request Forgery
Apache Ranger has Stored Cross-site Scripting vulnerability in Edit Service Page
Apache Ranger code execution vulnerability in policy expressions
Apache Ranger Hive Plugin missing permissions check
Apache Ranger Cross-site Scripting vulnerability
Apache Ranger allows users to bypass intended access restrictions via direct access to module URLs
Apache Ranger allows users to bypass intended access restrictions via the REST API
Apache Ranger Access Restriction Bypass
Cross-site scripting in Apache Ranger
Moderate severity vulnerability that affects org.apache.ranger:ranger
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character
UnixAuthenticationService in Apache Ranger was updated to correctly handle user input to avoid Stack-based buffer overflow
Apache Ranger policy engine incorrectly matches paths in certain conditions
Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies
Moderate severity vulnerability that affects org.apache.ranger:ranger
Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML
SQL injection vulnerability in the policy admin tool in Apache Ranger
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.