CVE-2015-1836

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.

Metrics

CVSS 3.0 7.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Dec 21, 2015
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-18385.3modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.CVE-2015-18395.3modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.CVE-2015-18405.0jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and CVE-2015-18413.7The Web Admin interface in Red Hat Enterprise Virtualization Manager (RHEV-M) allows local users to bypass the timeout function by selectingCVE-2015-184210.0The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daeCVE-2015-18434.3The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registCVE-2015-18444.0Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.CVE-2015-184510.0Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors.CVE-2015-18467.8unzoo allows remote attackers to cause a denial of service (infinite loop and resource consumption) via unspecified vectors to the (1) ExtrACVE-2015-18477.5Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally iCVE-2015-18486.8The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for reCVE-2015-18495.9AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information
CVE-2015-1836: High severity, CVSS 7.3 | Vulnix