In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
CVSS Score
5.4
EPSS Score
0.018
Published
2017-10-19
In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient.
CVSS Score
6.1
EPSS Score
0.035
Published
2017-06-12
Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin.
CVSS Score
7.5
EPSS Score
0.014
Published
2017-06-12
Page 2