Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.

This issue affects Apache Ranger: from 0.6 through 2.8.

SQL Injection vulnerability vulnerability in Apache Ranger.

This issue affects .

Users are recommended to upgrade to version 2.9.0, which fixes the issue.

Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.

Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.

Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Users are recommended to upgrade to version 2.6.0, which fixes this issue.

SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character - like mytest, test.txt. This can result in unintended behavior.

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.