Advisories · Technology
Apache Software Foundation Apache Storm Nimbus.
Every CVE that names Apache Software Foundation Apache Storm Nimbus among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.8 High
Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name
- Apache Software Foundation Apache Storm Nimbus
- Path traversal
- CVSS 6.5 Medium
Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI
- Apache Software Foundation Apache Storm Nimbus
- Apache Software Foundation Apache Storm UI
- Hard-coded credentials
- Broken access control
- CVSS 8.1 High
Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
- Apache Software Foundation Apache Storm Nimbus
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
- Apache Software Foundation Apache Storm Nimbus
- Apache Software Foundation Apache Storm Client
- Hard-coded credentials
- Information disclosure
- CVSS 6.5 Medium
Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location
- Apache Software Foundation Apache Storm Nimbus
- Path traversal
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
- Apache Software Foundation Apache Storm Nimbus
- Broken access control
- CWE-20
- CVSS 6.5 Medium
Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page
- Apache Software Foundation Apache Storm Nimbus
- Apache Software Foundation Apache Storm UI
- Information disclosure
- Hard-coded credentials