WaratekVRT Sign in

Apache Camel CVEs

116 CVEs, 3 exploited, 41 protected by Waratek

Reset
More filters (2)
Columns
Vendor apache✕Product camel✕
Overview 116 matches · 41 protected · 3 exploited · 0 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
116matches 41protected35.3% 3exploited2.6% 0CISA KEV0.0% 2public PoC1.7% 2EPSS ≥ 0.51.7%
Protected by Waratek 41 35.3% Rule in development 0 0.0% Mitigation candidate 3 2.6% No exploit published 72 62.1%
Critical 33 28.4% High 39 33.6% Medium 42 36.2% Low 2 1.7% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 41 35.3% partly blocked 0 0.0% not blocked 75 64.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 2.6% Working exploit published 0 0.0% Proof of concept only 4 3.4% Forecast only 0 0.0% No public exploit 109 94.0%
split by peak 89 / year
No exploit published: 72Mitigation candidate: 3Protected by Waratek: 41 Low: 2Medium: 42High: 39Critical: 33 not blocked: 75blocked by ARMR today: 41 No public exploit: 109Proof of concept only: 4Exploited: 3
20131 No exploit published1 Medium1 not blocked1 No public exploit1 20142 Protected by Waratek2 High2 blocked by ARMR today2 No public exploit2 20152 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 20162 No exploit published2 Critical1 High1 not blocked2 No public exploit2 20175 Protected by Waratek3 No exploit published2 Critical4 High1 blocked by ARMR today3 not blocked2 No public exploit5 20182 Protected by Waratek2 Critical1 Medium1 blocked by ARMR today2 No public exploit2 20192 Protected by Waratek2 High2 blocked by ARMR today2 No public exploit2 20204 Protected by Waratek2 No exploit published2 Critical2 High2 blocked by ARMR today2 not blocked2 No public exploit4 20210 20220 20231 No exploit published1 Low1 not blocked1 No public exploit1 20243 Protected by Waratek2 No exploit published1 Critical1 High2 blocked by ARMR today2 not blocked1 No public exploit3 20253 Mitigation candidate2 No exploit published1 Medium3 not blocked3 Exploited2 No public exploit1 202689 Protected by Waratek26 Mitigation candidate1 No exploit published62 Critical24 High29 Medium35 Low1 blocked by ARMR today26 not blocked63 Exploited1 Proof of concept only4 No public exploit84
2014201620182020202220242026
116 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2019-0188 High 2019-05-28 Protected by Waratek No public exploit Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.
CVE-2019-0194 High 2019-04-30 Protected by Waratek No public exploit Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.
CVE-2018-8041 Medium 2018-09-17 Protected by Waratek No public exploit Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.
CVE-2018-8027 Critical 2018-07-31 Protected by Waratek No public exploit Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.
CVE-2017-12634 Critical 2017-11-15 Protected by Waratek No public exploit The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
CVE-2017-12633 Critical 2017-11-15 Protected by Waratek No public exploit The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
CVE-2016-8749 Critical 2017-03-28 No exploit published No public exploit Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.
CVE-2017-5643 High 2017-03-16 Protected by Waratek No public exploit Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
CVE-2017-3159 Critical 2017-03-07 No exploit published No public exploit Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.
CVE-2015-5348 High 2016-04-15 No exploit published No public exploit Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
CVE-2015-5344 Critical 2016-02-03 No exploit published No public exploit The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
CVE-2015-0264 Medium 2015-06-03 Protected by Waratek No public exploit Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
CVE-2015-0263 Medium 2015-06-03 Protected by Waratek No public exploit XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
CVE-2014-0003 High 2014-03-21 Protected by Waratek No public exploit The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.
CVE-2014-0002 High 2014-03-21 Protected by Waratek No public exploit The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2013-4330 Medium 2013-10-04 No exploit published No public exploit Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.
‹ prev page 2 of 2 next ›