org.apache.ranger:ranger vulnerabilities (Maven)

17 vulnerabilities.

• org.apache.ranger:ranger Maven Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder CVE-2026-28672 Public exploit 9.8 CriticalAugust 10, 2026
• org.apache.ranger:ranger Maven Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost CVE-2024-45479 Fix available 9.1 CriticalJanuary 21, 2025
• org.apache.ranger:ranger Maven Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input CVE-2024-45478 Fix available 4.8 MediumJanuary 21, 2025
• org.apache.ranger:ranger Maven Apache Ranger: code execution vulnerability in policy expressions CVE-2022-45048 Fix available 8.4 HighMay 5, 2023
• org.apache.ranger:ranger Maven Cross-site scripting in Apache Ranger CVE-2019-12397 Fix available 6.1 MediumAugust 8, 2019
• org.apache.ranger:ranger Maven UnixAuthenticationService in Apache Ranger was updated to correctly handle user input to avoid Stack-based buffer overflow CVE-2018-11778 Fix available 8.8 HighOctober 5, 2018
• org.apache.ranger:ranger Maven Moderate severity vulnerability that affects org.apache.ranger:ranger CVE-2016-6815 Fix available 6.5 MediumOctober 13, 2017
• org.apache.ranger:ranger Maven Moderate severity vulnerability that affects org.apache.ranger:ranger CVE-2017-7677 Fix available 5.9 MediumJune 14, 2017
• org.apache.ranger:ranger Maven Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character CVE-2017-7676 Fix available 9.8 CriticalJune 14, 2017
• org.apache.ranger:ranger Maven Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies CVE-2016-8751 Fix available 4.8 MediumJune 14, 2017
• org.apache.ranger:ranger Maven Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML CVE-2016-5395 Fix available 4.8 MediumSeptember 26, 2016
• org.apache.ranger:ranger Maven SQL injection vulnerability in the policy admin tool in Apache Ranger CVE-2016-2174 Fix available 7.2 HighJune 13, 2016
• org.apache.ranger:ranger Maven The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password CVE-2016-0733 Fix available 9.8 CriticalApril 12, 2016
• org.apache.ranger:ranger Maven Apache Ranger allows users to bypass intended access restrictions via the REST API CVE-2015-5167 Fix available 6.5 MediumApril 12, 2016
• org.apache.ranger:ranger Maven Apache Ranger Access Restriction Bypass CVE-2016-0735 Fix available 8.8 HighApril 11, 2016
• org.apache.ranger:ranger Maven Apache Ranger allows users to bypass intended access restrictions via direct access to module URLs CVE-2015-0266 Fix available 7.1 HighApril 11, 2016
• org.apache.ranger:ranger Maven Apache Ranger Cross-site Scripting vulnerability CVE-2015-0265 Fix available 6.1 MediumApril 11, 2016