CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-34538 – Apache Hive Security vulnerability in Hive with UDFs
https://notcve.org/view.php?id=CVE-2021-34538
16 Jul 2022 — Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious. Las operaciones de función "CREATE" y "DROP" de Apache Hive versiones anteriores a 3.1.3, no comprueban la autorización... • https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0CVE-2020-13949 – libthrift: potential DoS when processing untrusted payloads
https://notcve.org/view.php?id=CVE-2020-13949
12 Feb 2021 — In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. En Apache Thrift versiones 0.9.3 hasta 0.13.0, los clientes RPC maliciosos podrían enviar mensajes cortos que resultarían en una gran asignación de memoria, conllevando potencialmente a una denegación de servicio A flaw was found in libthrift. Applications using Thrift would not show an error upon receiving messages declaring containers ... • https://lists.apache.org/thread.html/r01b34416677f1ba869525e1b891ac66fa6f88c024ee4d7cdea6b456b%40%3Cissues.hbase.apache.org%3E • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 25%CPEs: 2EXPL: 0CVE-2018-21234
https://notcve.org/view.php?id=CVE-2018-21234
21 May 2020 — Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set. Jodd versiones anteriores a la versión 5.0.4, realiza una Deserialización de Datos JSON No Confiables, cuando se establece la función setClassMetadataName. • https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16 • CWE-502: Deserialization of Untrusted Data •