[
  {"cve_id":"CVE-2025-48988","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","exploit_maturity":"Forecast only","published":"2025-06-16","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2025-48976","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.","exploit_maturity":"Forecast only","published":"2025-06-16","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2024-54676","description":"Vendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0\n\nDescription: Default clustering instructions at  https://openmeetings.apache.org/Clustering.html  doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data.\nUsers are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.","exploit_maturity":"Forecast only","published":"2025-01-08","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-54003","description":"Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.","exploit_maturity":"Forecast only","published":"2024-11-27","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"},
  {"cve_id":"CVE-2024-27136","description":"XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.  Apache JSPWiki users should upgrade to 2.12.2 or later. ","exploit_maturity":"Forecast only","published":"2024-06-24","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2024-31997","description":"XWiki Platform is a generic wiki platform. Prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, parameters of UI extensions are always interpreted as Velocity code and executed with programming rights. Any user with edit right on any document like the user's own profile can create UI extensions. This allows remote code execution and thereby impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.19, 15.5.4 and 15.9-RC1. No known workarounds are available.","exploit_maturity":"Forecast only","published":"2024-04-10","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2024-31465","description":"XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any page can execute any code on the server by adding an object of type `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1. As a workaround, manually apply the patch to the document `XWiki.SearchSuggestSourceSheet`.","exploit_maturity":"Forecast only","published":"2024-04-10","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2024-27317","description":"In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like \"..\", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with \"functionsWorkerEnabled=true\".\n\nThis issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. \n\n2.10 Pulsar Function Worker users should upgrade to at least 2.10.6.\n2.11 Pulsar Function Worker users should upgrade to at least 2.11.4.\n3.0 Pulsar Function Worker users should upgrade to at least 3.0.3.\n3.1 Pulsar Function Worker users should upgrade to at least 3.1.3.\n3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.","exploit_maturity":"Forecast only","published":"2024-03-12","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-28156","description":"Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure Build Monitor Views.","exploit_maturity":"Forecast only","published":"2024-03-06","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2024-23898","description":"Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.","exploit_maturity":"Forecast only","published":"2024-01-24","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"},
  {"cve_id":"CVE-2023-50721","description":"XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros including Groovy macros that allow remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki instance. This attack can be executed by any user who can edit some wiki page like the user's profile (editable by default) as user interface extensions that will be displayed in the search administration can be added on any document by any user.  The necessary escaping has been added in XWiki 14.10.15, 15.5.2 and 15.7RC1. As a workaround, the patch can be applied manually applied to the page `XWiki.SearchAdmin`.","exploit_maturity":"Forecast only","published":"2023-12-15","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2023-45138","description":"Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any particular rights. The vulnerability has been fixed in Change Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document `ChangeRequest.Code.ChangeRequestSheet` and by performing the same change as in the fix commit.","exploit_maturity":"Forecast only","published":"2023-10-12","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2023-40176","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. Even though the time zone is selected from a drop down (no free text value) it can still be set from JavaScript (using the browser developer tools) or by calling the save URL on the user profile with the right query string. Once the time zone is set it is displayed without escaping which means the payload gets executed for any user that visits the malicious user profile, allowing the attacker to steal information and even gain more access rights (escalation to programming rights). This issue is present since version 4.1M2 when the time zone user preference was introduced. The issue has been fixed in XWiki 14.10.5 and 15.1RC1.","exploit_maturity":"Forecast only","published":"2023-08-23","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2023-35166","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5.\n","exploit_maturity":"Forecast only","published":"2023-06-20","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2023-32986","description":"Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.","exploit_maturity":"Forecast only","published":"2023-05-16","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"},
  {"cve_id":"CVE-2023-32985","description":"Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.","exploit_maturity":"Forecast only","published":"2023-05-16","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2023-32071","description":"XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `\u003cxwiki app\u003e/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.","exploit_maturity":"Forecast only","published":"2023-05-09","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2023-32007","description":"** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This issue was disclosed earlier as CVE-2022-33891, but incorrectly claimed version 3.1.3 (which has since gone EOL) would not be affected.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\nUsers are recommended to upgrade to a supported version of Apache Spark, such as version 3.4.0.","exploit_maturity":"Forecast only","published":"2023-05-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-21931","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Forecast only","published":"2023-04-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-26477","description":"XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters. This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit `FlamingoThemesCode.WebHomeSheet` and manually perform the changes from the patch fixing the issue.\n","exploit_maturity":"Forecast only","published":"2023-03-02","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2023-26475","description":"XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.","exploit_maturity":"Forecast only","published":"2023-03-02","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2023-25762","description":"Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.","exploit_maturity":"Forecast only","published":"2023-02-15","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2022-43396","description":"In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.","exploit_maturity":"Forecast only","published":"2022-12-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-24697","description":"Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.","exploit_maturity":"Forecast only","published":"2022-10-13","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-36096","description":"The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page `XWiki.DeletedAttachments` with the object editor, open the `JavaScriptExtension` object and apply on the content the changes that can be found on the fix commit.","exploit_maturity":"Forecast only","published":"2022-09-08","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2022-28732","description":"A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later.","exploit_maturity":"Forecast only","published":"2022-08-04","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2022-28731","description":"A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.","exploit_maturity":"Forecast only","published":"2022-08-04","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2022-28730","description":"A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.","exploit_maturity":"Forecast only","published":"2022-08-04","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2022-27166","description":"A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.","exploit_maturity":"Forecast only","published":"2022-08-04","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2022-34783","description":"Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.","exploit_maturity":"Forecast only","published":"2022-06-30","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2022-34777","description":"Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.","exploit_maturity":"Forecast only","published":"2022-06-30","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2022-34176","description":"Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.","exploit_maturity":"Forecast only","published":"2022-06-23","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2022-30956","description":"Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads.","exploit_maturity":"Forecast only","published":"2022-05-17","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2022-29036","description":"Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.","exploit_maturity":"Forecast only","published":"2022-04-12","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2022-23307","description":"CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.","exploit_maturity":"Forecast only","published":"2022-01-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-23302","description":"JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.","exploit_maturity":"Forecast only","published":"2022-01-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-20615","description":"Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.","exploit_maturity":"Forecast only","published":"2022-01-12","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2021-45456","description":"Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.","exploit_maturity":"Forecast only","published":"2022-01-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-44832","description":"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","exploit_maturity":"Forecast only","published":"2021-12-28","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2021-21699","description":"Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","exploit_maturity":"Forecast only","published":"2021-11-12","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2021-38294","description":"A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.","exploit_maturity":"Forecast only","published":"2021-10-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-41303","description":"Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.","exploit_maturity":"Forecast only","published":"2021-09-17","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-2401","description":"Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","exploit_maturity":"Forecast only","published":"2021-07-21","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"},
  {"cve_id":"CVE-2021-2400","description":"Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Forecast only","published":"2021-07-21","resolved":"NO-FIX-IDENTIFIED","severity":"High"},
  {"cve_id":"CVE-2021-33037","description":"Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.","exploit_maturity":"Forecast only","published":"2021-07-12","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"},
  {"cve_id":"CVE-2021-21668","description":"Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.","exploit_maturity":"Forecast only","published":"2021-06-16","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2021-21667","description":"Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.","exploit_maturity":"Forecast only","published":"2021-06-16","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2021-31618","description":"Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.","exploit_maturity":"Forecast only","published":"2021-06-15","resolved":"NO-FIX-IDENTIFIED","severity":"High"},
  {"cve_id":"CVE-2021-30181","description":"Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.","exploit_maturity":"Forecast only","published":"2021-06-01","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-30180","description":"Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.","exploit_maturity":"Forecast only","published":"2021-06-01","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-22160","description":"If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to \"none\". This allows an attacker to connect to Pulsar instances as any user (incl. admins).","exploit_maturity":"Forecast only","published":"2021-05-26","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21659","description":"Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"Forecast only","published":"2021-05-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21649","description":"Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.","exploit_maturity":"Forecast only","published":"2021-05-11","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2021-2198","description":"Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Knowledge Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Knowledge Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Knowledge Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","exploit_maturity":"Forecast only","published":"2021-04-22","resolved":"NO-FIX-IDENTIFIED","severity":"High"},
  {"cve_id":"CVE-2021-2190","description":"Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Template). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Sales Offline. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Sales Offline. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","exploit_maturity":"Forecast only","published":"2021-04-22","resolved":"NO-FIX-IDENTIFIED","severity":"High"},
  {"cve_id":"CVE-2021-28165","description":"In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.","exploit_maturity":"Forecast only","published":"2021-04-01","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"},
  {"cve_id":"CVE-2021-21630","description":"Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","exploit_maturity":"Forecast only","published":"2021-03-30","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2021-21628","description":"Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","exploit_maturity":"Forecast only","published":"2021-03-30","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2021-21344","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"Forecast only","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21341","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"Forecast only","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-27223","description":"In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.","exploit_maturity":"Forecast only","published":"2021-02-26","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2021-21618","description":"Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.","exploit_maturity":"Forecast only","published":"2021-02-24","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2021-21616","description":"Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","exploit_maturity":"Forecast only","published":"2021-02-24","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2020-13947","description":"An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.","exploit_maturity":"Forecast only","published":"2021-02-08","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2021-2114","description":"Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications Calendar. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications Calendar, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications Calendar accessible data as well as unauthorized update, insert or delete access to some of Oracle Common Applications Calendar accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","exploit_maturity":"Forecast only","published":"2021-01-20","resolved":"NO-FIX-IDENTIFIED","severity":"High"},
  {"cve_id":"CVE-2020-7774","description":"The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.","exploit_maturity":"Forecast only","published":"2020-11-17","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2020-14841","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Forecast only","published":"2020-10-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-13957","description":"Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.","exploit_maturity":"Forecast only","published":"2020-10-13","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2020-13943","description":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","exploit_maturity":"Forecast only","published":"2020-10-12","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2019-0233","description":"An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.","exploit_maturity":"Forecast only","published":"2020-09-14","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"},
  {"cve_id":"CVE-2020-11998","description":"A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html \"A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code.\" Mitigation: Upgrade to Apache ActiveMQ 5.15.13","exploit_maturity":"Forecast only","published":"2020-09-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-13934","description":"An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.","exploit_maturity":"Forecast only","published":"2020-07-14","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"},
  {"cve_id":"CVE-2020-2950","description":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Forecast only","published":"2020-04-15","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2020-2871","description":"Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","exploit_maturity":"Forecast only","published":"2020-04-15","resolved":"NO-FIX-IDENTIFIED","severity":"High"},
  {"cve_id":"CVE-2020-2854","description":"Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","exploit_maturity":"Forecast only","published":"2020-04-15","resolved":"NO-FIX-IDENTIFIED","severity":"High"},
  {"cve_id":"CVE-2020-2852","description":"Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Calendar). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","exploit_maturity":"Forecast only","published":"2020-04-15","resolved":"NO-FIX-IDENTIFIED","severity":"High"},
  {"cve_id":"CVE-2014-9390","description":"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.","exploit_maturity":"Forecast only","published":"2020-02-12","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2019-10173","description":"It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)","exploit_maturity":"Forecast only","published":"2019-07-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-10072","description":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","exploit_maturity":"Forecast only","published":"2019-06-21","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"},
  {"cve_id":"CVE-2019-0199","description":"The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.","exploit_maturity":"Forecast only","published":"2019-04-10","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"},
  {"cve_id":"CVE-2019-0190","description":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.","exploit_maturity":"Forecast only","published":"2019-01-30","resolved":"NO-FIX-IDENTIFIED","severity":"High"},
  {"cve_id":"CVE-2018-11770","description":"From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.","exploit_maturity":"Forecast only","published":"2018-08-13","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"},
  {"cve_id":"CVE-2018-1275","description":"Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.","exploit_maturity":"Forecast only","published":"2018-04-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-12616","description":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.","exploit_maturity":"Forecast only","published":"2017-09-19","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"},
  {"cve_id":"CVE-2016-5388","description":"Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue. NOTE: the vendor states \"A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388\"; in other words, this is not a CVE ID for a vulnerability.","exploit_maturity":"Forecast only","published":"2016-07-19","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"},
  {"cve_id":"CVE-2016-2510","description":"BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.","exploit_maturity":"Forecast only","published":"2016-04-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-0742","description":"The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.","exploit_maturity":"Forecast only","published":"2016-02-15","resolved":"NO-EXPLOIT-PUBLISHED","severity":"High"},
  {"cve_id":"CVE-2016-0489","description":"Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Test Manager for Web Apps.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the ActionServlet servlet, which allows remote authenticated users to upload and execute arbitrary files via directory traversal sequences in the tempfilename parameter in a ReportImage action.","exploit_maturity":"Forecast only","published":"2016-01-21","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2016-0488","description":"Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0492.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function in the admin pages, which allows remote attackers to bypass authentication and gain administrator access via directory traversal sequences following a URI entry that does not require authentication.","exploit_maturity":"Forecast only","published":"2016-01-21","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2016-0487","description":"Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0490.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the process method in the ActionServlet servlet, which allows remote attackers to bypass authentication via directory traversal sequences following an unspecified URI string.","exploit_maturity":"Forecast only","published":"2016-01-21","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2014-0054","description":"The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.","exploit_maturity":"Forecast only","published":"2014-04-17","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2013-5704","description":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding.  NOTE: the vendor states \"this is not a security issue in httpd as such.\"","exploit_maturity":"Forecast only","published":"2014-04-15","resolved":"NO-FIX-IDENTIFIED","severity":"Medium"},
  {"cve_id":"CVE-2013-6429","description":"The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.","exploit_maturity":"Forecast only","published":"2014-01-26","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2013-6397","description":"Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT.  NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.","exploit_maturity":"Forecast only","published":"2013-12-07","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2013-1571","description":"Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to frame injection in HTML that is generated by Javadoc.","exploit_maturity":"Forecast only","published":"2013-06-18","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"},
  {"cve_id":"CVE-2010-2227","description":"Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with \"recycling of a buffer.\"","exploit_maturity":"Forecast only","published":"2010-07-13","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Medium"}
]