Advisories · Technology
Apache Software Foundation Apache Ranger.
Every CVE that names Apache Software Foundation Apache Ranger among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Ranger: SQL Injection vulnerability in lookup functionality
- Apache Software Foundation Apache Ranger
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Ranger: Privilege Escalation via URL Parameter
- Apache Software Foundation Apache Ranger
- Privilege escalation
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Ranger: Remote Code Execution via JDBC URL Injection
- Apache Software Foundation Apache Ranger
- Code injection
- CWE-20
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation
- Apache Software Foundation Apache Ranger
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator
- Apache Software Foundation Apache Ranger
- Code injection
- CVSS 7.5 High
Apache Ranger: Download APIs expose plugin data without authentication
- Apache Software Foundation Apache Ranger
- Authentication bypass
- CVSS 7.5 High
Apache Ranger: Clients accept TLS certificates issued for other hostnames
- Apache Software Foundation Apache Ranger
- Weak cryptography or TLS
- CVSS 6.5 Medium
Apache Ranger: Logs contain replayable JWT bearer tokens
- Apache Software Foundation Apache Ranger
- Information disclosure
- CVSS 7.3 High
Apache Ranger: UnixAuth lacks brute-force protection
- Apache Software Foundation Apache Ranger
- Authentication bypass