CL
Vendor
Cloudera
55
CVEs
0
On KEV
0
New 30D
Products
CM9.8
Cloudera Manager
Cloudera
22 CVEs0 on KEV0 new
CD8.8
Cdh
Cloudera
11 CVEs0 on KEV0 new
HU7.5
Hue
Cloudera
6 CVEs0 on KEV0 new
DS9.9
Data Science Workbench
Cloudera
5 CVEs0 on KEV0 new
MA7.5
Manager
Cloudera
3 CVEs0 on KEV0 new
DE8.8
Data Engineering
Cloudera
2 CVEs0 on KEV0 new
CC–
Cloudera Cdh
Cloudera
1 CVEs0 on KEV0 new
CS–
Cloudera Service And Configuration Manager
Cloudera
1 CVEs0 on KEV0 new
HA–
Hadoop
Cloudera
1 CVEs0 on KEV0 new
KT9.8
Key Trustee Server
Cloudera
1 CVEs0 on KEV0 new
NA3.1
Navigator
Cloudera
1 CVEs0 on KEV0 new
NK4.9
Navigator Key Trustee Kms
Cloudera
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-3884 | HU Hue Cloudera | 7.5 | May 22 | Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability |
| CVE-2021-32483 | CM Cloudera Manager Cloudera | 5.3 | Nov 8 | Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard |
| CVE-2021-30132 | CM Cloudera Manager Cloudera | 9.8 | Nov 8 | Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges |
| CVE-2021-32482 | CM Cloudera Manager Cloudera | 6.1 | Nov 8 | Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter |
| CVE-2021-32481 | HU Hue Cloudera | 6.1 | Nov 8 | Cloudera Hue 4.6.0 allows XSS via the type parameter |
| CVE-2021-29994 | HU Hue Cloudera | 6.1 | Nov 8 | Cloudera Hue 4.6.0 allows XSS |
| CVE-2021-29243 | CM Cloudera Manager Cloudera | 6.1 | Nov 8 | Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS |
| CVE-2021-3167 | DE Data Engineering Cloudera | 6.5 | Mar 15 | In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs |
| CVE-2020-26936 | DE Data Engineering Cloudera | 8.8 | Nov 26 | Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack |
| CVE-2019-14449 | CM Cloudera Manager Cloudera | 5.4 | Nov 26 | An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1 |
| CVE-2019-7319 | CD Cdh Cloudera | 8.3 | Nov 26 | An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0 |
| CVE-2018-20090 | DS Data Science Workbench Cloudera | 8.3 | Nov 26 | An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2 |
| CVE-2017-7399 | CM Cloudera Manager Cloudera | 8.8 | Nov 26 | Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the… |
| CVE-2016-9271 | CM Cloudera Manager Cloudera | 5.4 | Nov 26 | Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature |
| CVE-2018-17860 | CD Cdh Cloudera | 7.2 | Nov 26 | Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1 |
| CVE-2015-4457 | CM Cloudera Manager Cloudera | 5.4 | Nov 26 | Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using… |
| CVE-2016-6353 | CD Cdh Cloudera | 6.5 | Nov 26 | Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the RealTimeGetHandler |
| CVE-2016-5724 | CD Cdh Cloudera | 7.5 | Nov 26 | Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles |
| CVE-2016-4572 | CD Cdh Cloudera | 8.8 | Nov 26 | In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges |
| CVE-2016-3192 | CM Cloudera Manager Cloudera | 6.5 | Nov 26 | Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files |
| CVE-2016-3131 | CD Cdh Cloudera | 6.5 | Nov 26 | Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls |
| CVE-2015-7831 | CD Cdh Cloudera | 8.8 | Nov 26 | In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used |
| CVE-2015-6495 | CM Cloudera Manager Cloudera | 7.5 | Nov 26 | There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles |
| CVE-2018-11744 | CM Cloudera Manager Cloudera | 8.1 | Jul 11 | Cloudera Manager through 5.15 has Incorrect Access Control |
| CVE-2017-9327 | CM Cloudera Manager Cloudera | 6.5 | Jul 3 | Secret data of processes managed by CM is not secured by file permissions |
| CVE-2017-9326 | CM Cloudera Manager Cloudera | 7.5 | Jul 3 | The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed by Cloudera Manager |
| CVE-2017-9325 | CD Cdh Cloudera | 7.5 | Jul 3 | The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs |
| CVE-2018-11215 | DS Data Science Workbench Cloudera | 9.8 | Jul 3 | Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and prior releases via unspecified attack vectors |
| CVE-2018-15665 | DS Data Science Workbench Cloudera | 5.3 | Jun 21 | An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.2.x through 1.4.0 |
| CVE-2018-15913 | CM Cloudera Manager Cloudera | 6.1 | Jun 20 | An issue was discovered in Cloudera Manager 5.x through 5.15.0 |
| CVE-2018-20091 | DS Data Science Workbench Cloudera | 9.9 | Jun 7 | An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2 |
| CVE-2018-6185 | CM Cloudera Manager Cloudera | 4.9 | Jun 7 | In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys |
| CVE-2018-5798 | CM Cloudera Manager Cloudera | 6.1 | Jun 7 | This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager |
| CVE-2018-10815 | CM Cloudera Manager Cloudera | 6.5 | May 24 | An issue was discovered in Cloudera Manager before 5.13.4, 5.14.x before 5.14.4, and 5.15.x before 5.15.1 |
| CVE-2015-8094 | HU Hue Cloudera | 6.1 | May 22 | Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next… |
| CVE-2017-15536 | DS Data Science Workbench Cloudera | 8.8 | Feb 5 | An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.x before 1.2.0 |
| CVE-2016-6605 | CD Cdh Cloudera | 7.5 | Apr 10 | Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization |
| CVE-2015-4166 | KT Key Trustee Server Cloudera | 9.8 | Mar 23 | Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key |
| CVE-2015-4078 | CM Cloudera Manager Cloudera | 3.1 | Mar 23 | Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to… |
| CVE-2015-2263 | CM Cloudera Manager Cloudera | 3.3 | Mar 23 | Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when… |
| CVE-2014-0229 | CD Cdh Cloudera | 6.5 | Mar 23 | Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool,… |
| CVE-2013-6446 | CD Cdh Cloudera | 3.1 | Mar 23 | The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows remote authenticated users to obtain… |
| CVE-2016-4950 | MA Manager Cloudera | 7.5 | Mar 7 | Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions |
| CVE-2016-4949 | MA Manager Cloudera | 7.5 | Mar 7 | Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) stdout.log value in the filename parameter to… |
| CVE-2016-4948 | MA Manager Cloudera | 6.1 | Mar 7 | Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Template Name… |
| CVE-2016-4947 | HU Hue Cloudera | 5.3 | Mar 7 | Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete |
| CVE-2016-4946 | HU Hue Cloudera | 6.1 | Mar 7 | Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) First name or (2)… |
| CVE-2014-8733 | CM Cloudera Manager Cloudera | – | Feb 10 | Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in unspecified world-readable files under /etc/hadoop, which allows local users to obtain this… |
| CVE-2014-0220 | CM Cloudera Manager Cloudera | – | Jun 10 | Cloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to obtain sensitive configuration information via the API |
| CVE-2012-2230 | CM Cloudera Manager Cloudera | – | Apr 12 | Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote… |
| CVE-2012-1574 | CC Cloudera Cdh Cloudera | – | Apr 12 | The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through… |