{"id":"CVE-2016-0760","details":"Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2) reflect2, or (3) java_method Hive builtin functions.","modified":"2026-07-08T05:45:53.417543250Z","published":"2016-08-19T21:59:03.417Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"1.6.0"},{"last_affected":"1.6.0"}],"source":"CPE_STRING","vendor_product":"apache:sentry","cpes":["cpe:2.3:a:apache:sentry:1.6.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"ADVISORY","url":"http://mail-archives.apache.org/mod_mbox/sentry-dev/201608.mbox/%3CCACMN7ixDqDyOZGLEvsMUVHBiJ6crq8zdy%2B2mNfRooNhnk7CJ1g%40mail.gmail.com%3E"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/92328"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/sentry","events":[{"introduced":"d9ee8ade724d7ecc7433517bfb769da2cd002b0b"},{"last_affected":"d9ee8ade724d7ecc7433517bfb769da2cd002b0b"}],"database_specific":{"extracted_events":[{"introduced":"1.5.1"},{"last_affected":"1.5.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:apache:sentry:1.5.1:*:*:*:*:*:*:*"}}],"versions":["1.5.1","release-1.5.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-0760.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}