[
  {"cve_id":"CVE-2026-84939","description":"Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled).\n\nThis issue affects Apache FreeMarker from 2.2.0 through 2.3.34.\n\nUsers are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this.\n\nNote that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.","exploit_maturity":"No public exploit","published":"2026-09-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-55559","description":"Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Deployments without security.yaml expose the operation through the guest superuser, while secured deployments require SystemPrivilege.CreateInstances. Successful exploitation executes commands as the Yamcs service account. This issue is fixed in versions 5.12.8 and 5.13.2.","exploit_maturity":"Proof of concept only","published":"2026-08-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-49845","description":"SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue.\n\nDetails about the issue:\nSeveral Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() → '...') instead of bind parameters. A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true). An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table \u0026 partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.","exploit_maturity":"No public exploit","published":"2026-08-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-66906","description":"Relative path traversal vulnerability in Apache Camel Azure Storage Blob component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0.\n\n\n\nThe camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem through its downloadBlobToFile operation, writing into the directory named by the fileDir endpoint option, which is documented as usable from both the producer and the consumer. BlobOperations.downloadBlobToFile built the local target by joining fileDir with the remote blob name exactly as the Azure SDK reported it (new File(fileDir, client.getBlobName())) and passed the result straight to the SDK download call, with no lexical normalization and no check that the resolved location stayed inside fileDir. The blob name is not route-controlled data: the consumer enumerates the container in BlobConsumer.createBatchExchangesFromContainer, which lists blobs and creates one exchange per entry from BlobItem.getName() verbatim, applying no name filtering by default. A blob name containing parent-directory segments therefore resolved to a location outside the configured fileDir, letting anyone able to influence the names present in the consumed container cause Camel to create or overwrite a file at a location of their choosing, with the privileges of the Camel process. Depending on what the process can write to, overwriting a file outside the download directory can escalate beyond the loss of integrity of that file. Azure Storage blob containers use a flat namespace in which the blob name is an opaque key, so a name carrying such segments is stored and listed as given. The fileDir option is an ordinary common-group configuration parameter and carries no security marker, so nothing signalled to users that its value was not being enforced as a containment boundary. Camel's other file-download consumers - camel-file, camel-ftp, camel-smb, camel-mina-sftp and camel-azure-files - already constrained their local downloads to the configured directory using a path-segment boundary check; the camel-azure-storage-blob download path was not covered by that work.\n\n\n\nUsers are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, constrain the names the consumer will act on using the regex endpoint option, which is applied to each listed blob name as a full-string match, so that only simple single-segment names are accepted and any name carrying a path separator or a parent-directory segment is filtered out before an exchange is created; the prefix option can additionally narrow the listing server-side, noting that when both are set regex takes priority and prefix is ignored. Alternatively, avoid the downloadBlobToFile operation on untrusted containers and write the payload from the route under a file name the route itself controls, rather than one taken from the remote listing. As defence in depth, treat the blob names in any externally writable container as untrusted input and do not derive local filesystem paths from them.","exploit_maturity":"No public exploit","published":"2026-08-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-76904","description":"GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(\u003ccolumn\u003e, \u003cpointer\u003e, \u003cvalue\u003e)` function writes `\u003cvalue\u003e` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.","exploit_maturity":"Working exploit published","published":"2026-08-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-28672","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.\n\nThis issue affects Apache Ranger: from 0.6 through 2.8.","exploit_maturity":"No public exploit","published":"2026-08-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-66909","description":"Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","exploit_maturity":"No public exploit","published":"2026-08-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-8400","description":"IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.","exploit_maturity":"No public exploit","published":"2026-08-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-70426","description":"In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.","exploit_maturity":"No public exploit","published":"2026-08-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-52680","description":"Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to write controlled content outside the intended upload directory, subject to filesystem permissions.\n\n\nThis issue affects Apache Kyuubi: from 1.7.0 through 1.11.1.\n\nUsers are recommended to upgrade to version 1.12.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2026-07-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-14974","description":"IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.","exploit_maturity":"No public exploit","published":"2026-07-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-14512","description":"IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.","exploit_maturity":"No public exploit","published":"2026-07-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-16723","description":"A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.","exploit_maturity":"Proof of concept only","published":"2026-07-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-64609","description":"Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.\n\nThis issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.\n\nUsers are recommended to upgrade to version 1.4.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2026-07-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-64606","description":"Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected\n\n\nThis issue affects Apache Fory: from before 1.4.0.\n\nUsers are recommended to upgrade to version 1.4.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2026-07-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-46562","description":"Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type(\"java.lang.Runtime\").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.","exploit_maturity":"Proof of concept only","published":"2026-07-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-43867","description":"Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component.\n\nThe camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from the configured AWS Secrets Manager secret by Base64-decoding the stored value and deserializing it with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. A principal who can write to the AWS Secrets Manager secret that holds this metadata (requiring secretsmanager:PutSecretValue on that secret) could store a crafted serialized object that is deserialized during normal key-lifecycle operations, potentially leading to code execution in the context of the application that manages the keys. This is the same underlying defect, in the same code path and remediated by the same fix, as CVE-2026-46590, which was reported independently and additionally covers the HashiCorp Vault and file-based sibling managers; both are incomplete-remediation follow-ons to CVE-2026-40048 (CAMEL-23200).\nThis issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, restrict write access to the AWS Secrets Manager secret that holds the camel-pqc key metadata so that only the application’s own identity holds secretsmanager:PutSecretValue on it (least-privilege IAM), and keep the PQC key material in a secret separate from any data that less-trusted principals can write.","exploit_maturity":"No public exploit","published":"2026-07-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-40047","description":"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component.\n\nThe camel-docling component invokes the external `docling` command-line tool by assembling an argument list in DoclingProducer and executing it through java.lang.ProcessBuilder. Custom CLI arguments supplied through the `CamelDoclingCustomArguments` exchange header (a List\u003cString\u003e) were appended to that argument list with insufficient validation: the original implementation relied on a denylist of disallowed flags and only rejected path values that contained a literal `../` sequence. As a result, a Camel route that forwards externally-influenced data into the `CamelDoclingCustomArguments` header (or into the path-bearing headers used to build the invocation) could cause the producer to pass unrecognized or unintended `docling` CLI flags to the subprocess, and could supply path-like argument values that resolved outside the intended directory through traversal sequences not caught by the literal `../` check. Because Camel itself builds the `docling` invocation from these values, the component is responsible for constraining them, and the weak validation allowed CLI-argument injection and directory traversal in the arguments passed to the external tool. The invocation uses the list-based form of ProcessBuilder, so a shell does not interpret the argument values; OS command injection through shell metacharacters was not possible, and the metacharacter rejection added by the fix is defense-in-depth.\nThis issue affects Apache Camel: from 4.15.0 before 4.18.3.\n\nUsers are recommended to upgrade to a release that contains the CAMEL-23212 fix. On the mainline the fix is included from Apache Camel 4.19.0 (and later releases such as 4.20.0). For users on the 4.18.x LTS releases stream, upgrade to 4.18.3. The fix replaces the denylist with a strict allowlist of recognized `docling` CLI flags (rejecting any unrecognized flag, and rejecting producer-managed flags such as the output-directory flags), defensively rejects shell metacharacters in argument values, and normalizes path-like values with Path.normalize() before validating them so that traversal sequences which bypass a literal `../` check are detected. As defence in depth, route authors should avoid mapping untrusted message content into the `CamelDoclingCustomArguments` header and the path-bearing headers, and should strip Camel-internal headers from messages that arrive from untrusted producers.","exploit_maturity":"No public exploit","published":"2026-07-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-24014","description":"Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.\n\nThis issue affects Apache IoTDB: from 1.3.3 before 2.0.8.\n\nUsers are recommended to upgrade to version 2.0.8, which fixes the issue.","exploit_maturity":"No public exploit","published":"2026-07-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-53914","description":"In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata","exploit_maturity":"No public exploit","published":"2026-06-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-49875","description":"Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) \nexternal entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.","exploit_maturity":"No public exploit","published":"2026-06-12","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-41699","description":"Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.\n\nAffected versions:\nSpring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.","exploit_maturity":"No public exploit","published":"2026-06-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-35273","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2026-06-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-41855","description":"In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.","exploit_maturity":"No public exploit","published":"2026-06-09","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-50076","description":"Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data.\n\nUsers are recommended to upgrade to version 1.1.0 or later, which fixes this issue.","exploit_maturity":"No public exploit","published":"2026-06-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-47065","description":"ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy\n\n\nAssessment: Fully addressed.\n\n\nWhen the serialised stream contains a TC_PROXYCLASSDESC (the marker \nfor a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc()\n is\ndispatched. JDK then calls the default \nObjectInputStream.resolveProxyClass(interfaces) implementation, which \nperforms Class.forName(intf, false, latestUserDefinedLoader()) for EACH \ninterface name and constructs the proxy class — bypassing the accepted\n classes list .\n\n\nZDRES-233: Class.forName(name, initialize=true, classLoader) in \nreadClassDescriptor Triggers Static Initialiser of Allow-Listed Classes\n\n\nAssessment: Fully addressed.\n\n\nFor ANY class on the allow-list, deserialising a stream that names it triggers the class’s \n (static initialiser) BEFORE any instance is constructed. This means an \nattacker who supplies a class name on the allow-list (e.g., the \ndeveloper wrote accept(“com.myapp.*\") , attacker supplies \ncom.myapp.SomeClass ) causes \u003cclinit\u003e of SomeClass — and many \nreal-world classes have side-effecting static initialisers\n\n\nBoth issues have been fixed.","exploit_maturity":"No public exploit","published":"2026-06-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-9319","description":"IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.","exploit_maturity":"No public exploit","published":"2026-06-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-23734","description":"XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg\u0026minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17.","exploit_maturity":"No public exploit","published":"2026-05-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-8178","description":"An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath.\n\n\n\nTo mitigate this issue, users should upgrade to version 2.2.2 or later.","exploit_maturity":"No public exploit","published":"2026-05-08","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-41586","description":"Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.","exploit_maturity":"Proof of concept only","published":"2026-05-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-40982","description":"Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.\nSpring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.","exploit_maturity":"No public exploit","published":"2026-05-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-40076","description":"OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the module upload endpoint at POST `/openmrs/ws/rest/v1/module` is vulnerable to a Zip Slip path traversal attack. During automatic extraction of uploaded .omod archives in `WebModuleUtil.startModule()`, ZIP entries under web/module/ are checked only to see whether the full entry path starts with `..,` and the remaining path is then concatenated into the destination path without normalization or a boundary check. A crafted archive can therefore include entries such as `web/module/../../../../malicious.jsp` and cause files to be written outside the intended module directory.\n\nAn authenticated attacker with module upload access can write arbitrary files to locations such as the web application root and achieve remote code execution by uploading a JSP file and then requesting it. The issue is compounded by the fact that the module.allow_web_admin runtime property is enforced in the legacy UI controller but not in the REST API upload path, so deployments relying on that property to block web-based module administration remain exposed through the REST endpoint. This issue has been fixed in versions after 2.7.8 in the 2.7.x line and in version 2.8.6 and later.","exploit_maturity":"Proof of concept only","published":"2026-05-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-7411","description":"In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.","exploit_maturity":"Proof of concept only","published":"2026-05-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-42027","description":"Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader\n\n\n\n\n\nVersions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3\n\n\n\n\n\nDescription: \n\nThe ExtensionLoader.instantiateExtension(Class, String) method loads a class by its fully-qualified name via Class.forName() and invokes its no-arg constructor, with the class name sourced from the manifest.properties entry of a model archive. The existing isAssignableFrom check correctly rejects classes that are not subtypes of the expected extension interface (BaseToolFactory for factory=, ArtifactSerializer for serializer-class-*), but the check runs after Class.forName() has already loaded and initialized the named class. \n\nClass.forName() with default initialization semantics executes the target class's static initializer before returning, so an attacker who can supply a crafted model archive can cause the static initializer of any class on the classpath to run during model loading, regardless of whether that class passes the subsequent type check. \n\nExploitation requires a class with attacker-useful side effects in its static initializer (for example, JNDI lookup, outbound network I/O, or filesystem access) to be present on the classpath, so this is not a drop-in remote code execution; however, the attack surface grows as third-party model distribution becomes more common (community model repositories, Hugging Face-style sharing), where users routinely load model files from origins they do not control. A secondary, narrower vector affects deployments that ship legitimate BaseToolFactory or ArtifactSerializer subclasses with side-effecting no-arg constructors: a malicious manifest can name such a class and force its constructor to run during model load.\n\n\n\n\n\nMitigation: \n\n\n\n  *  2.x users should upgrade to 2.5.9. \n  *  3.x users should upgrade to 3.0.0-M3. \n\n\n\n\nNote: The fix introduces a package-prefix allowlist that is consulted before Class.forName() is invoked, so the static initializer of a disallowed class is never executed. Classes under the opennlp. prefix remain permitted by default. Deployments that load models referencing factories or serializers outside opennlp.* must opt those packages in, either programmatically via ExtensionLoader.registerAllowedPackage(String) before the first model load, or by setting the OPENNLP_EXT_ALLOWED_PACKAGES system property to a comma-separated list of allowed package prefixes. \n\nUsers who cannot upgrade immediately should ensure that all model files are sourced from trusted origins and should audit their classpath for classes with side-effecting static initializers or constructors, particularly any that perform JNDI lookups, network requests, or filesystem operations during class initialization.","exploit_maturity":"No public exploit","published":"2026-05-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-40682","description":"XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor\n\n\nVersions Affected: before 2.5.9, before 3.0.0-M3\n\n\nDescription: The DictionaryEntryPersistor class initializes a static SAXParserFactory at class-load time without enabling FEATURE_SECURE_PROCESSING or disabling DTD processing. When create(InputStream, EntryInserter) is invoked, the only feature set on the XMLReader is namespace support — external entity resolution and DOCTYPE declarations remain fully enabled. An attacker who can supply a crafted dictionary file (e.g., a stop-word list or domain dictionary) containing a malicious DOCTYPE declaration can trigger local file disclosure via file:// entity references or server-side request forgery via http:// entity references during SAX parsing, before the application processes a single dictionary entry. This is inconsistent with the project's own XmlUtil.createSaxParser() helper, which correctly sets FEATURE_SECURE_PROCESSING and disallow-doctype-decl and is used by all other XML parsing paths in the codebase. The public Dictionary(InputStream) constructor delegates directly to this method and is the documented API for loading user-supplied dictionaries, making untrusted input a realistic scenario.\n\n\nMitigation: 2.x users should upgrade to 2.5.9. 3.x users should upgrade to 3.0.0-M3. Users who cannot upgrade immediately should ensure that all dictionary files are sourced from trusted origins and should consider wrapping the Dictionary(InputStream) constructor with input validation that rejects any XML containing a DOCTYPE declaration before it reaches the parser.","exploit_maturity":"No public exploit","published":"2026-05-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-42779","description":"The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:\n\n\n\n\n\n\n\n\n\n\n\nApache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.\n\n\n\n\nThe fix checks if the class is present in the accepted class filter before calling Class.forName(). \n\n\n\n\n\n\nAffected versions are Apache MINA 2.1.0 \u003c= 2.1.11, and 2.2.0 \u003c= 2.2.6.\n\n\n\n\n\nThe problem is resolved in Apache MINA 2.1.12, and 2.2.7 by \napplying the classname allowlist earlier.\n\n\n\n\n\nAffected are applications using Apache MINA that call  IoBuffer.getObject().\n\n\n\n\n\nApplications using Apache MINA are advised to upgrade.","exploit_maturity":"Proof of concept only","published":"2026-05-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-42778","description":"The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:\n\n\n\n\nThe fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.\n\n\n\n\nAffected versions are Apache MINA 2.1.0 \u003c= 2.1.11, and 2.2.0 \u003c= 2.2.6.\n\n\n\n\nThe problem is resolved in Apache MINA 2.1.12, and 2.2.7 by \napplying the classname allowlist earlier.\n\n\n\n\nAffected are applications using Apache MINA that call IoBuffer.getObject().\n\n\n\n\nApplications using Apache MINA are advised to upgrade\n\n\n\n\n\n\nThe fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.\n\n\n\n\nAffected versions are Apache MINA 2.1.0 \u003c= 2.1.110, and 2.2.0 \u003c= 2.2.6.\n\n\n\n\nThe problem is resolved in Apache MINA 2.1.12, and 2.2.7 by \napplying the classname allowlist earlier.\n\n\n\n\nAffected are applications using Apache MINA that call IoBuffer.getObject().\n\n\n\n\nApplications using Apache MINA are advised to upgrade","exploit_maturity":"No public exploit","published":"2026-05-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-36767","description":"A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.","exploit_maturity":"Proof of concept only","published":"2026-04-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-41635","description":"Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.\n\n\n\n\nThe fix checks if the class is present in the accepted class filter before calling Class.forName(). \n\n\n\n\n\n\nAffected versions are Apache MINA 2.0.0 \u003c= 2.0.27, 2.1.0 \u003c= 2.1.10, and\n\n\n2.2.0 \u003c= 2.2.5.\n\n\n\n\n\nThe problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by \napplying the classname allowlist earlier.\n\n\n\n\n\nAffected are applications using Apache MINA that call  IoBuffer.getObject().\n\n\n\n\n\nApplications using Apache MINA are advised to upgrade.","exploit_maturity":"No public exploit","published":"2026-04-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-41409","description":"The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.\n\n\n\n\nAffected versions are Apache MINA 2.0.0 \u003c= 2.0.27, 2.1.0 \u003c= 2.1.10, and 2.2.0 \u003c= 2.2.5.\n\n\n\n\nThe problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by \napplying the classname allowlist earlier.\n\n\n\n\nAffected are applications using Apache MINA that call IoBuffer.getObject().\n\n\n\n\nApplications using Apache MINA are advised to upgrade","exploit_maturity":"No public exploit","published":"2026-04-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-40860","description":"JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel application could achieve remote code execution when a deserialization gadget chain was present on the classpath. The same handling was reached transitively through camel-sjms2 (whose Sjms2Endpoint extends SjmsEndpoint) and through camel-amqp (whose AMQPJmsBinding extends JmsBinding), and by other JMS-family components built on JmsComponent such as camel-activemq and camel-activemq6.\n\nThis issue affects Apache Camel: from 3.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.","exploit_maturity":"No public exploit","published":"2026-04-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-33454","description":"The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure the 'in' direction via setInFilterStartsWith. As a result, when a Camel application consumes mail through camel-mail (for example via from(\\\"imap://...\\\") or from(\\\"pop3://...\\\")) the inbound filter check is skipped and Camel-prefixed MIME headers are mapped unfiltered into the Exchange. An attacker who can deliver an email to a mailbox monitored by such a consumer can inject Camel-specific headers that, for some Camel components downstream of the mail consumer (such as camel-bean, camel-exec, or camel-sql), can alter the behaviour of the route. This is the same pattern that was previously addressed in camel-undertow (CVE-2025-30177) and the broader incoming-header filter (CVE-2025-27636 and CVE-2025-29891).\n\nThis issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1.\n\nUsers are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.1. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6.","exploit_maturity":"No public exploit","published":"2026-04-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-41245","description":"Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes the issue.","exploit_maturity":"No public exploit","published":"2026-04-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-35580","description":"Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0.","exploit_maturity":"No public exploit","published":"2026-04-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-33439","description":"Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains \u003cjato:form\u003e tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.","exploit_maturity":"Working exploit published","published":"2026-04-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-33728","description":"dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, dd-trace-java is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, a JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable, Third, a gadget-chain-compatible library is present on the classpath. For JDK \u003e= 17, no action is required, but upgrading is strongly encouraged. For JDK \u003e= 8u121 \u003c JDK 17, upgrade to dd-trace-java version 1.60.3 or later. For JDK \u003c 8u121 and earlier where serialization filters are not available, apply the workaround. The workaround is to set the following environment variable to disable the RMI integration: `DD_INTEGRATION_RMI_ENABLED=false`.","exploit_maturity":"No public exploit","published":"2026-03-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-33701","description":"OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, OpenTelemetry Java instrumentation is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable. Third, gadget-chain-compatible library is present on the classpath. This results in arbitrary remote code execution with the privileges of the user running the instrumented JVM. For JDK \u003e= 17, no action is required, but upgrading is strongly encouraged. For JDK \u003c 17, upgrade to version 2.26.1 or later. As a workaround, set the system property `-Dotel.instrumentation.rmi.enabled=false` to disable the RMI integration.","exploit_maturity":"No public exploit","published":"2026-03-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-15057","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","exploit_maturity":"No public exploit","published":"2026-01-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-65482","description":"An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.","exploit_maturity":"Proof of concept only","published":"2026-01-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-65091","description":"XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starting a DoS attack. This issue has been patched in version 2.4.5.","exploit_maturity":"No public exploit","published":"2026-01-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-14306","description":"A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.  https://robo-code.blogspot.com/","exploit_maturity":"No public exploit","published":"2025-12-09","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-66516","description":"Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. \n\nThis CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. \n\nFirst, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to \u003e= 3.2.2 would still be vulnerable. \n\nSecond, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the \"org.apache.tika:tika-parsers\" module.","exploit_maturity":"Working exploit published","published":"2025-12-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-58360","description":"GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.","exploit_maturity":"Exploited in the wild","published":"2025-11-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-10713","description":"An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities.\n\nA successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.","exploit_maturity":"No public exploit","published":"2025-11-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-56316","description":"A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.","exploit_maturity":"No public exploit","published":"2025-10-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-52472","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available.","exploit_maturity":"Working exploit published","published":"2025-10-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-61882","description":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2025-10-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-6544","description":"A deserialization vulnerability exists in h2oai/h2o-3 versions \u003c= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.","exploit_maturity":"Proof of concept only","published":"2025-09-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-59340","description":"jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classes. This enables the creation of semi-arbitrary class instances without directly invoking restricted methods or class literals. As a result, an attacker can escape the sandbox and instantiate classes such as java.net.URL, opening up the ability to access local files and URLs(e.g., file:///etc/passwd). With further chaining, this primitive can potentially lead to remote code execution (RCE). This vulnerability is fixed in 2.8.1.","exploit_maturity":"No public exploit","published":"2025-09-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-55748","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg\u0026minify=false`. This is fixed in version 16.10.7.","exploit_maturity":"Working exploit published","published":"2025-09-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-55747","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions  6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.","exploit_maturity":"Working exploit published","published":"2025-09-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-58059","description":"Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. This includes but is not limited to: running executables on the application host, inspecting and extracting data from the host environment or application properties, spring beans (application context, database pooling). The following conditions have to be met in order to perform this attack: the user must be logged in, have the admin role, and must have some knowledge about running scripts via a the Camunda/Operator engine. Version 12.16.0 and 13.1.2 have been patched. It is strongly advised to upgrade. If no scripting is needed in any of the processes, it could be possible to disable it altogether via the ProcessEngineConfiguration. However, this workaround could lead to unexpected side-effects.","exploit_maturity":"No public exploit","published":"2025-08-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-54988","description":"Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.\n\nUsers are recommended to upgrade to version 3.2.2, which fixes this issue.","exploit_maturity":"Working exploit published","published":"2025-08-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-53606","description":"Deserialization of Untrusted Data vulnerability in Apache Seata (incubating).\n\nThis issue affects Apache Seata (incubating): 2.4.0.\n\nUsers are recommended to upgrade to version 2.5.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2025-08-08","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-32429","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.","exploit_maturity":"Working exploit published","published":"2025-07-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-32897","description":"Deserialization of Untrusted Data vulnerability in Apache Seata (incubating).\n\nThis security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow.\nThis issue affects Apache Seata (incubating): from 2.0.0 before 2.3.0.\n\nSeverity Justification:\nThe Apache Seata security team assesses the severity of this vulnerability as \"Low\" due to stringent real-world mitigating factors. First, the vulnerability is strictly isolated to the Raft cluster mode, an optional and non-default feature introduced in v2.0.0, while most users rely on the unaffected traditional architecture. Second, Seata is an internal middleware; communication between TC and RM/TM occurs entirely within trusted internal networks. An attacker would require prior, unauthorized access to the Intranet to exploit this, making external exploitation highly improbable.\nUsers are recommended to upgrade to version 2.3.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2025-06-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-36038","description":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.","exploit_maturity":"No public exploit","published":"2025-06-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-56158","description":"XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.","exploit_maturity":"No public exploit","published":"2025-06-12","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-30220","description":"GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.","exploit_maturity":"Working exploit published","published":"2025-06-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-34711","description":"GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities (XEE) attack, then send GET request to any HTTP server. By default, GeoServer use PreventLocalEntityResolver class from GeoTools to filter out malicious URIs in XML entities before resolving them. The URI must match the regex (?i)(jar:file|http|vfs)[^?#;]*\\\\.xsd. But the regex leaves a chance for attackers to request to any HTTP server or limited file. Attacker can abuse this to scan internal networks and gain information about them then exploit further. GeoServer 2.25.0 and greater default to the use of ENTITY_RESOLUTION_ALLOWLIST and does not require you to provide a system property.","exploit_maturity":"No public exploit","published":"2025-06-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-27531","description":"Deserialization of Untrusted Data vulnerability in Apache InLong. \n\nThis issue affects Apache InLong: from 1.13.0 before 2.1.0, \n\nthis issue would allow an authenticated attacker to read arbitrary files by double writing the param.\n\n\n\n\n\nUsers are recommended to upgrade to version 2.1.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2025-06-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-27528","description":"Deserialization of Untrusted Data vulnerability in Apache InLong.\n\nThis issue affects Apache InLong: from 1.13.0 through 2.1.0. \n\nThis\nvulnerability allows attackers to bypass the security mechanisms of InLong\nJDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/11747","exploit_maturity":"No public exploit","published":"2025-05-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-4641","description":"Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux (XML parsing components modules) allows Data Serialization External Entities Blowup. This vulnerability is associated with program files src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java.\n\nThis issue affects webdrivermanager: from 1.0.0 before 6.0.2.","exploit_maturity":"No public exploit","published":"2025-05-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-2905","description":"Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products.\n\nA successful XXE attack could allow a remote, unauthenticated attacker to:\n  *  Read sensitive files from the server’s filesystem.\n  *  Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.","exploit_maturity":"No public exploit","published":"2025-05-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-32969","description":"XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when \"Prevent unregistered users from viewing pages, regardless of the page rights\" and \"Prevent unregistered users from editing pages, regardless of the page rights\" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki.","exploit_maturity":"Working exploit published","published":"2025-04-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-29085","description":"SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.","exploit_maturity":"Working exploit published","published":"2025-04-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-30065","description":"Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code\n\n\nUsers are recommended to upgrade to version 1.15.1, which fixes the issue.","exploit_maturity":"Proof of concept only","published":"2025-04-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-47552","description":"Deserialization of Untrusted Data vulnerability in Apache Seata (incubating).\n\n\n\n\n\nThis issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0.\n\n\n\n\n\nSeverity Justification:\n\nThe Apache Seata security team assesses the severity of this vulnerability as \"Low\" due to stringent real-world mitigating factors. First, the vulnerability is strictly isolated to the Raft cluster mode, an optional and non-default feature introduced in v2.0.0, while most users rely on the unaffected traditional architecture. Second, Seata is an internal middleware; communication between TC and RM/TM occurs entirely within trusted internal networks. An attacker would require prior, unauthorized access to the Intranet to exploit this, making external exploitation highly improbable.\n\n\n\n\n\nUsers are recommended to upgrade to version 2.2.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2025-03-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-10553","description":"A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0.","exploit_maturity":"Proof of concept only","published":"2025-03-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-24813","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","exploit_maturity":"Exploited in the wild","published":"2025-03-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-38693","description":"Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173.","exploit_maturity":"No public exploit","published":"2025-03-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-37361","description":"The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502)\n\n\n\n \n\n\n\nHitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.\n\n\n\n \n\n\n\nWhen developers place no restrictions on \"gadget chains,\" or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions.","exploit_maturity":"No public exploit","published":"2025-02-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-56180","description":"CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\\linux\\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue.","exploit_maturity":"No public exploit","published":"2025-02-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-52577","description":"In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.","exploit_maturity":"No public exploit","published":"2025-02-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-0851","description":"A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.","exploit_maturity":"No public exploit","published":"2025-01-29","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-21535","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2025-01-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-54676","description":"Vendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0\n\nDescription: Default clustering instructions at  https://openmeetings.apache.org/Clustering.html  doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data.\nUsers are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.","exploit_maturity":"Forecast only","published":"2025-01-08","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-52046","description":"The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process\nincoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows\nattackers to exploit the deserialization process by sending specially crafted malicious serialized data,\npotentially leading to remote code execution (RCE) attacks.\n\n\n\n\t\t\t\t\t\n\n\n\t\t\t\t\n\n\n\t\t\t\n\n\n\t\t\n\n\n\t\nThis issue affects MINA core versions 2.0.X, 2.1.X and 2.2.X, and will be fixed by the releases 2.0.27, 2.1.10 and 2.2.4.\n\n\n\n\n\nIt's also important to note that an application using MINA core library will only be affected if the IoBuffer#getObject() method is called, and this specific method is potentially called when adding a ProtocolCodecFilter instance using the ObjectSerializationCodecFactory class in the filter chain. If your application is specifically using those classes, you have to upgrade to the latest version of MINA core library.\n\n\n\n\nUpgrading will  not be enough: you also need to explicitly allow the classes the decoder will accept in the ObjectSerializationDecoder instance, using one of the three new methods:\n\n\n\n\n    /**\n\n     * Accept class names where the supplied ClassNameMatcher matches for\n\n     * deserialization, unless they are otherwise rejected.\n\n     *\n\n     * @param classNameMatcher the matcher to use\n\n     */\n\n    public void accept(ClassNameMatcher classNameMatcher)\n\n\n\n\n    /**\n\n     * Accept class names that match the supplied pattern for\n\n     * deserialization, unless they are otherwise rejected.\n\n     *\n\n     * @param pattern standard Java regexp\n\n     */\n\n    public void accept(Pattern pattern) \n\n\n\n\n\n    /**\n\n     * Accept the wildcard specified classes for deserialization,\n\n     * unless they are otherwise rejected.\n\n     *\n\n     * @param patterns Wildcard file name patterns as defined by\n\n     *                  {@link org.apache.commons.io.FilenameUtils#wildcardMatch(String, String) FilenameUtils.wildcardMatch}\n\n     */\n\n    public void accept(String... patterns)\n\n\n\n\n\n\n\nBy default, the decoder will reject *all* classes that will be present in the incoming data.\n\n\n\n\n\n\n\nNote: The FtpServer, SSHd and Vysper sub-project are not affected by this issue.","exploit_maturity":"No public exploit","published":"2024-12-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-55875","description":"http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances. The original fix shipped in v5.41.0.0 / v4.50.0.0 closed the documented external-entity attack class (SSRF, local-file disclosure, code execution) by setting `ACCESS_EXTERNAL_DTD=\"\"`, `ACCESS_EXTERNAL_SCHEMA=\"\"`, and `isExpandEntityReferences=false` on the default `DocumentBuilderFactory`. A residual gap remained: the parser still accepted documents containing `\u003c!DOCTYPE\u003e` declarations even though external entity resolution was blocked. This left open billion-laughs-style internal entity expansion DoS attacks against any application using `Body.xml()` or `Document.asXmlDocument()` on untrusted XML. v6.50.0.0 closes this residual by adding `disallow-doctype-decl=true` and `FEATURE_SECURE_PROCESSING=true` to `defaultXmlParsingConfig`. Any document containing a `\u003c!DOCTYPE\u003e` is now rejected at parse time.","exploit_maturity":"Proof of concept only","published":"2024-12-12","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-53677","description":"File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.\n\nThis issue affects Apache Struts: from 2.0.0 before 6.4.0.\n\nUsers are recommended to upgrade to version 6.4.0 at least and migrate to the new  file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.\n\nYou can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067","exploit_maturity":"Proof of concept only","published":"2024-12-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-51135","description":"An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.","exploit_maturity":"Proof of concept only","published":"2024-11-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-51132","description":"An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.","exploit_maturity":"Proof of concept only","published":"2024-11-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-48307","description":"JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.","exploit_maturity":"Working exploit published","published":"2024-10-31","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-47883","description":"The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the `java.net.URL` class to refer to (what are expected to be) local resource files, like images or templates. This works: \"opening a connection\" to these URLs opens the local file. However, prior to version 1.2.6, if a `file:/` URL is directly given where a relative path (resource name) is expected, this is also accepted in some code paths; the app then fetches the file, from a remote machine if indicated, and uses it as if it was a trusted part of the app's codebase. This leads to multiple weaknesses and potential weaknesses. An attacker that has network access to the application could use it to gain access to files, either on the the server's filesystem (path traversal) or shared by nearby machines (server-side request forgery with e.g. SMB). An attacker that can lead or redirect a user to a crafted URL belonging to the app could cause arbitrary attacker-controlled JavaScript to be loaded in the victim's browser (cross-site scripting). If an app is written in such a way that an attacker can influence the resource name used for a template, that attacker could cause the app to fetch and execute an attacker-controlled template (remote code execution). Version 1.2.6 contains a patch.","exploit_maturity":"Proof of concept only","published":"2024-10-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-25581","description":"pac4j is a security framework for Java. `pac4j-core` prior to version 4.0.0 is affected by a Java deserialization vulnerability. The vulnerability affects systems that store externally controlled values in attributes of the `UserProfile` class from pac4j-core. It can be exploited by providing an attribute that contains a serialized Java object with a special prefix `{#sb64}` and Base64 encoding. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a `RestrictedObjectInputStream` is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. pac4j versions 4.0.0 and greater are not affected by this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.","exploit_maturity":"Proof of concept only","published":"2024-10-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-47561","description":"Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.\nUsers are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue.","exploit_maturity":"No public exploit","published":"2024-10-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-46984","description":"The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location routine in the referencevalidator commons package is vulnerable to `XML External Entities` attack due to insecure defaults of the used Woodstox WstxInputFactory. A malicious XML resource can lead to network requests issued by referencevalidator and thus to a `Server Side Request Forgery` attack. The vulnerability impacts applications which use referencevalidator to process XML resources from untrusted sources. The problem has been patched with the 2.5.1 version of the referencevalidator. Users are strongly recommended to update to this version or a more recent one. A pre-processing or manual analysis of input XML resources on existence of DTD definitions or external entities can mitigate the problem.","exploit_maturity":"No public exploit","published":"2024-09-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-46983","description":"sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. This issue is fixed by an update to the blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue. Users unable to upgrade may maintain a blacklist themselves in the directory `external/serialize.blacklist`.","exploit_maturity":"No public exploit","published":"2024-09-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-22399","description":"Deserialization of Untrusted Data vulnerability in Apache Seata. \n\nWhen developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private protocol.\n\nThis issue affects Apache Seata: 2.0.0, from 1.0.0 through 1.8.0.\n\nUsers are recommended to upgrade to version 2.1.0/1.8.1, which fixes the issue.","exploit_maturity":"No public exploit","published":"2024-09-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-45758","description":"H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.","exploit_maturity":"Proof of concept only","published":"2024-09-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-42469","description":"openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, CometVisu's file system endpoints don't require authentication and additionally the endpoint to update an existing file is susceptible to path traversal. This makes it possible for an attacker to overwrite existing files on the openHAB instance. If the overwritten file is a shell script that is executed at a later time, this vulnerability can allow remote code execution by an attacker. Users should upgrade to version 4.2.1 to receive a patch.","exploit_maturity":"No public exploit","published":"2024-08-12","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-37084","description":"In Spring Cloud Data Flow versions prior to 2.11.4,  a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server","exploit_maturity":"No public exploit","published":"2024-07-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-48362","description":"XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file.\nUsers are recommended to upgrade to version 1.21.2, which fixes this issue.","exploit_maturity":"No public exploit","published":"2024-07-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-5276","description":"A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.  Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this vulnerability. Successful unauthenticated exploitation requires a Workflow system with anonymous access enabled, otherwise an authenticated user is required. This issue affects all versions of FileCatalyst Workflow from 5.1.6 Build 135 and earlier.","exploit_maturity":"Working exploit published","published":"2024-06-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-36116","description":"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite provides support for JavaDocs files, which are archives that contain documentation for artifacts. Specifically, JavadocEndpoints.kt controller allows to expand the javadoc archive into the server's file system and return its content. The problem is in the way how the archives are expanded, specifically how the new filename is created. The `file.name` taken from the archive can contain path traversal characters, such as '/../../../anything.txt', so the resulting extraction path can be outside the target directory. If the archive is taken from an untrusted source, such as Maven Central or JitPack for example, an attacker can craft a special archive to overwrite any local file on Reposilite instance. This could lead to remote code execution, for example by placing a new plugin into the '$workspace$/plugins' directory. Alternatively, an attacker can overwrite the content of any other package. Note that the attacker can use its own malicious package from Maven Central to overwrite any other package on Reposilite. Reposilite has addressed this issue in version 3.5.12. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-073.","exploit_maturity":"Proof of concept only","published":"2024-06-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-37902","description":"DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers version 0.27.0. Users are advised to upgrade.","exploit_maturity":"No public exploit","published":"2024-06-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-32888","description":"The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that `preferQueryMode` is not a supported parameter in Redshift JDBC driver, and is inherited code from Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected. This issue is patched in driver version 2.1.0.28. As a workaround, do not use the connection property `preferQueryMode=simple`. (NOTE: Those who do not explicitly specify a query mode use the default of extended query mode and are not affected by this issue.)","exploit_maturity":"No public exploit","published":"2024-05-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-4701","description":"A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18","exploit_maturity":"Proof of concept only","published":"2024-05-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-26579","description":"Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, \n\n the attackers can bypass using malicious parameters.\n\nUsers are advised to upgrade to Apache InLong's 1.12.0 or cherry-pick [1], [2] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/9694 \n\n[2]  https://github.com/apache/inlong/pull/9707","exploit_maturity":"No public exploit","published":"2024-05-08","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-27348","description":"RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 \u0026 Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 \u0026 enable the Auth system, which fixes the issue.","exploit_maturity":"Exploited in the wild","published":"2024-04-22","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-3366","description":"A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259480.","exploit_maturity":"Proof of concept only","published":"2024-04-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-4963","description":"A vulnerability was found in Folio Spring Module Core up to 1.1.5. It has been rated as critical. Affected by this issue is the function dropSchema of the file tenant/src/main/java/org/folio/spring/tenant/hibernate/HibernateSchemaService.java of the component Schema Name Handler. The manipulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is d374a5f77e6b58e36f0e0e4419be18b95edcd7ff. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-257516.","exploit_maturity":"No public exploit","published":"2024-03-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-28125","description":"FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation.","exploit_maturity":"No public exploit","published":"2024-03-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-27317","description":"In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like \"..\", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with \"functionsWorkerEnabled=true\".\n\nThis issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. \n\n2.10 Pulsar Function Worker users should upgrade to at least 2.10.6.\n2.11 Pulsar Function Worker users should upgrade to at least 2.11.4.\n3.0 Pulsar Function Worker users should upgrade to at least 3.0.3.\n3.1 Pulsar Function Worker users should upgrade to at least 3.1.3.\n3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.","exploit_maturity":"Forecast only","published":"2024-03-12","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-28213","description":"nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.","exploit_maturity":"No public exploit","published":"2024-03-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-26580","description":"Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can \n\nuse the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/9673","exploit_maturity":"No public exploit","published":"2024-03-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-51518","description":"Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.\nGiven a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.\nNote that by default JMX endpoint is only bound locally.\n\nWe recommend users to:\n - Upgrade to a non-vulnerable Apache James version\n\n - Run Apache James isolated from other processes (docker - dedicated virtual machine)\n - If possible turn off JMX\n\n","exploit_maturity":"No public exploit","published":"2024-02-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-23114","description":"Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions it is possible to deserialize malicious payload.This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.\n\nUsers are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1\n\n","exploit_maturity":"No public exploit","published":"2024-02-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-1597","description":"pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.","exploit_maturity":"Proof of concept only","published":"2024-02-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-6267","description":"A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.","exploit_maturity":"No public exploit","published":"2024-01-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-23897","description":"Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.","exploit_maturity":"Exploited in the wild","published":"2024-01-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-23636","description":"SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Version 5.12.0 fixed this issue by adding a blacklist. SOFARPC also provides a way to add additional blacklists. Users can add a class like `-Drpc_serialize_blacklist_override=org.apache.xpath.` to avoid this issue.","exploit_maturity":"No public exploit","published":"2024-01-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-20189","description":"In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.","exploit_maturity":"Proof of concept only","published":"2024-01-22","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-50578","description":"Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.","exploit_maturity":"Working exploit published","published":"2023-12-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-41543","description":"SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.","exploit_maturity":"No public exploit","published":"2023-12-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-41542","description":"SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.","exploit_maturity":"Proof of concept only","published":"2023-12-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-51656","description":"Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4.\n\nUsers are recommended to upgrade to version 1.2.2, which fixes the issue.","exploit_maturity":"No public exploit","published":"2023-12-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-46279","description":"Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5.\n\nUsers are recommended to upgrade to the latest version, which fixes the issue.","exploit_maturity":"No public exploit","published":"2023-12-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-29234","description":"A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4.\n\nUsers are recommended to upgrade to the latest version, which fixes the issue.","exploit_maturity":"No public exploit","published":"2023-12-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-49093","description":"HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0","exploit_maturity":"Proof of concept only","published":"2023-12-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-48967","description":"Ssolon \u003c= 2.6.0 and \u003c=2.5.12 is vulnerable to Deserialization of Untrusted Data.","exploit_maturity":"No public exploit","published":"2023-12-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-49371","description":"RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.","exploit_maturity":"No public exploit","published":"2023-12-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-48887","description":"A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.","exploit_maturity":"No public exploit","published":"2023-12-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-49733","description":"Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0.\n\nUsers are recommended to upgrade to version 2.3.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2023-11-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-45135","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0.\n\nUsers are recommended to upgrade to version 2.3.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2023-11-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-49656","description":"Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2023-11-29","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-5245","description":"FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory.\n\nWhen creating an instance of TensorflowModel using the saved_model format and an exported tensorflow model, the apply() function invokes the vulnerable implementation of FileUtil.extract().\n\nArbitrary file creation can directly lead to code execution","exploit_maturity":"No public exploit","published":"2023-11-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-46502","description":"An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory.","exploit_maturity":"No public exploit","published":"2023-10-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-46604","description":"The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.","exploit_maturity":"Exploited in the wild","published":"2023-10-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-37913","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versions 14.10.8 and 15.3-rc-1, triggering the office converter with a specially crafted file name allows writing the attachment's content to an attacker-controlled location on the server as long as the Java process has write access to that location. In particular in the combination with attachment moving, a feature introduced in XWiki 14.0, this is easy to reproduce but it also possible to reproduce in versions as old as XWiki 3.5 by uploading the attachment through the REST API which doesn't remove `/` or `\\` from the filename. As the mime type of the attachment doesn't matter for the exploitation, this could e.g., be used to replace the `jar`-file of an extension which would allow executing arbitrary Java code and thus impact the confidentiality, integrity and availability of the XWiki installation. This vulnerability has been patched in XWiki 14.10.8 and 15.3RC1. There are no known workarounds apart from disabling the office converter.","exploit_maturity":"Proof of concept only","published":"2023-10-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-45278","description":"Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request.","exploit_maturity":"No public exploit","published":"2023-10-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-45146","description":"XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian serialization mechanism. When such a configuration is used, attackers may be able to connect to the server and provide malicious serialized objects that, once deserialized, force it to execute arbitrary code. This can be abused to take control of the machine the server is running by way of remote code execution. This issue has not been fixed.","exploit_maturity":"Proof of concept only","published":"2023-10-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-43668","description":"Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, \n\nsome sensitive params  checks will be bypassed, like \"autoDeserizalize\",\"allowLoadLocalInfile\"....\n\n.  \n\nUsers are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/8604 \n\n","exploit_maturity":"No public exploit","published":"2023-10-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-42809","description":"Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running in. Version 3.22.0 contains a patch for this issue.\n\nSome post-fix advice is available. Do NOT use `Kryo5Codec` as deserialization codec, as it is still vulnerable to arbitrary object deserialization due to the `setRegistrationRequired(false)` call. On the contrary, `KryoCodec` is safe to use. The fix applied to `SerializationCodec` only consists of adding an optional allowlist of class names, even though making this behavior the default is recommended. When instantiating `SerializationCodec` please use the `SerializationCodec(ClassLoader classLoader, Set\u003cString\u003e allowedClasses)` constructor to restrict the allowed classes for deserialization.","exploit_maturity":"Proof of concept only","published":"2023-10-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-40989","description":"SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.","exploit_maturity":"No public exploit","published":"2023-09-22","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-41887","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.","exploit_maturity":"Proof of concept only","published":"2023-09-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-42268","description":"Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.","exploit_maturity":"Proof of concept only","published":"2023-09-08","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-41034","description":"Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to `XXE Attacks`. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version. If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory.  This issue has been fixed in versions 1.5.0 and 2.0.0-M13. Users are advised to upgrade. There are no known workarounds for this vulnerability.","exploit_maturity":"No public exploit","published":"2023-08-31","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-40787","description":"In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.","exploit_maturity":"No public exploit","published":"2023-08-29","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-36480","description":"The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.","exploit_maturity":"Proof of concept only","published":"2023-08-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-38992","description":"jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.","exploit_maturity":"Working exploit published","published":"2023-07-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-38647","description":"An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation.\n\nAffect all the versions lower and include 1.2.0.\n\nAffected products: helix-core, helix-rest\n\nMitigation: Short term, stop using any YAML based configuration and workflow creation.\n                  Long term, all Helix version bumping up to 1.3.0 \n\n","exploit_maturity":"No public exploit","published":"2023-07-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-37895","description":"Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component \"commons-beanutils\", which contains a class that can be used for remote code execution over RMI.\n\nUsers are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore.\n\nIn general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases.\n\nHow to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit webapp/standalone.\n\nThe native RMI protocol by default uses port 1099. To check whether it is enabled, tools like \"netstat\" can be used to check.\n\nRMI-over-HTTP in Jackrabbit by default uses the path \"/rmi\". So when running standalone on port 8080, check whether an HTTP GET request on localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control.\n\nTurning off RMIFind web.xml (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet:\n\n        \u003cservlet\u003e\n            \u003cservlet-name\u003eRMI\u003c/servlet-name\u003e\n            \u003cservlet-class\u003eorg.apache.jackrabbit.servlet.remote.RemoteBindingServlet\u003c/servlet-class\u003e\n        \u003c/servlet\u003e\n\n        \u003cservlet-mapping\u003e\n            \u003cservlet-name\u003eRMI\u003c/servlet-name\u003e\n            \u003curl-pattern\u003e/rmi\u003c/url-pattern\u003e\n        \u003c/servlet-mapping\u003e\n\nFind the bootstrap.properties file (in $REPOSITORY_HOME), and set\n\n         rmi.enabled=false\n\n    and also remove\n\n         rmi.host\n         rmi.port\n         rmi.url-pattern\n\n If there is no file named bootstrap.properties in $REPOSITORY_HOME, it is located somewhere in the classpath. In this case, place a copy in $REPOSITORY_HOME and modify it as explained.","exploit_maturity":"No public exploit","published":"2023-07-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-37460","description":"Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remote code execution. When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the `resolveFile()` function will return the symlink's source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later `Files.newOutputStream()`, that follows symlinks by default,  will actually write the entry's content to the symlink's target. Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. Version 4.8.0 contains a patch for this issue.","exploit_maturity":"Proof of concept only","published":"2023-07-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-35088","description":"Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. \nIn the toAuditCkSql method, the groupId, streamId, auditId, and dt are directly concatenated into the SQL query statement, which may lead to SQL injection attacks.\nUsers are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/8198","exploit_maturity":"No public exploit","published":"2023-07-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-34478","description":"Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.\n\nMitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+","exploit_maturity":"No public exploit","published":"2023-07-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-26512","description":"CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\\V1.8.0 on windows\\linux\\mac os e.g. platforms allows attackers to send controlled message and \n\nremote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue, we will release the new version as soon as possible.","exploit_maturity":"No public exploit","published":"2023-07-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-4361","description":"Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.","exploit_maturity":"No public exploit","published":"2023-07-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-35839","description":"A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload.","exploit_maturity":"No public exploit","published":"2023-06-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-34659","description":"jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.","exploit_maturity":"Working exploit published","published":"2023-06-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-33496","description":"xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecode#decode.","exploit_maturity":"Proof of concept only","published":"2023-06-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-31890","description":"An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() parameter.","exploit_maturity":"Proof of concept only","published":"2023-05-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-27554","description":"\nIBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185.\n\n","exploit_maturity":"No public exploit","published":"2023-05-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-25826","description":"Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was previously disclosed as CVE-2020-35476. Regex validation that was implemented to restrict allowed input to the query API does not work as intended, allowing crafted commands to bypass validation.","exploit_maturity":"Working exploit published","published":"2023-05-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-45802","description":"Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high-risk files, and may upload them to any directory, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later\n\n\n\n\n\n\n","exploit_maturity":"No public exploit","published":"2023-05-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-29216","description":"In Apache Linkis \u003c=1.3.1, because the parameters are not\neffectively filtered, the attacker uses the MySQL data source and malicious parameters to\nconfigure a new data source to trigger a deserialization vulnerability, eventually leading to\nremote code execution.\n Versions of Apache Linkis \u003c= 1.3.0 will be affected.\nWe recommend users upgrade the version of Linkis to version 1.3.2.","exploit_maturity":"No public exploit","published":"2023-04-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-29215","description":"In Apache Linkis \u003c=1.3.1, due to the lack of effective filtering\nof parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a\ndeserialization vulnerability and eventually lead to remote code execution. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. Versions of Apache Linkis \u003c= 1.3.0 will be affected.\nWe recommend users upgrade the version of Linkis to version 1.3.2.","exploit_maturity":"No public exploit","published":"2023-04-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-27603","description":"\n\n\nIn Apache Linkis \u003c=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability.\n\n\nWe recommend users upgrade the version of Linkis to version 1.3.2.\n\n\n\n","exploit_maturity":"No public exploit","published":"2023-04-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-25330","description":"A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valuer. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications that avoid SQL injection.","exploit_maturity":"Proof of concept only","published":"2023-04-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-20913","description":"SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.","exploit_maturity":"Proof of concept only","published":"2023-04-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-28677","description":"Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a convertion by Jenkins Convert To Pipeline Plugin.","exploit_maturity":"No public exploit","published":"2023-04-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-1741","description":"A vulnerability was found in jeecg-boot 3.5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file SysDictMapper.java of the component Sleep Command Handler. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224629 was assigned to this vulnerability.","exploit_maturity":"No public exploit","published":"2023-03-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-1454","description":"A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.","exploit_maturity":"Working exploit published","published":"2023-03-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-23638","description":"A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. \n\nThis issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions. ","exploit_maturity":"Proof of concept only","published":"2023-03-08","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-25158","description":"GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable `encode functions` for PostGIS DataStores or enable `prepared statements` for JDBCDataStores as a partial mitigation.","exploit_maturity":"No public exploit","published":"2023-02-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-25157","description":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols.  CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.","exploit_maturity":"Working exploit published","published":"2023-02-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2014-125087","description":"A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480.","exploit_maturity":"No public exploit","published":"2023-02-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-24188","description":"ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted.","exploit_maturity":"Proof of concept only","published":"2023-02-13","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-24997","description":"Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick  https://github.com/apache/inlong/pull/7223 https://github.com/apache/inlong/pull/7223  to solve it.\n\n","exploit_maturity":"No public exploit","published":"2023-02-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-24163","description":"SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.","exploit_maturity":"No public exploit","published":"2023-01-31","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-24162","description":"Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.","exploit_maturity":"Proof of concept only","published":"2023-01-31","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-24443","description":"Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2023-01-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-24441","description":"Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2023-01-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-24430","description":"Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2023-01-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-24429","description":"Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.","exploit_maturity":"No public exploit","published":"2023-01-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-47105","description":"Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.","exploit_maturity":"Proof of concept only","published":"2023-01-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-3782","description":"keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.","exploit_maturity":"No public exploit","published":"2023-01-13","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-15011","description":"A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the file dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.2 is able to address this issue. The identifier of the patch is ec4238349691ec66dd30b416ec6eaab02d722302. It is recommended to upgrade the affected component. The identifier VDB-217549 was assigned to this vulnerability.","exploit_maturity":"No public exploit","published":"2023-01-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-36641","description":"A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.14.0 is able to address this issue. The patch is identified as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.","exploit_maturity":"No public exploit","published":"2023-01-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-36640","description":"A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.","exploit_maturity":"No public exploit","published":"2023-01-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-32824","description":"Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbitrary bean manipulation in the Telnet handler. The Dubbo main service port can be used to access a Telnet Handler which offers some basic methods to collect information about the providers and methods exposed by the service and it can even allow to shutdown the service. This endpoint is unprotected. Additionally, a provider method can be invoked using the `invoke` handler. This handler uses a safe version of FastJson to process the call arguments. However, the resulting list is later processed with `PojoUtils.realize` which can be used to instantiate arbitrary classes and invoke its setters. Even though FastJson is properly protected with a default blocklist, `PojoUtils.realize` is not, and an attacker can leverage that to achieve remote code execution. Versions 2.6.10 and 2.7.10 contain fixes for this issue.","exploit_maturity":"Proof of concept only","published":"2023-01-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-44621","description":"Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.","exploit_maturity":"No public exploit","published":"2022-12-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-20151","description":"A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.","exploit_maturity":"No public exploit","published":"2022-12-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-4493","description":"A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/io/scif/util/DefaultSampleFilesService.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215803.","exploit_maturity":"No public exploit","published":"2022-12-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-46682","description":"Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-12-12","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-4375","description":"A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.","exploit_maturity":"Working exploit published","published":"2022-12-09","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-46366","description":"Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.","exploit_maturity":"No public exploit","published":"2022-12-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-1471","description":"SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.","exploit_maturity":"Proof of concept only","published":"2022-12-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-45207","description":"Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.","exploit_maturity":"Proof of concept only","published":"2022-11-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-45206","description":"Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check.","exploit_maturity":"Proof of concept only","published":"2022-11-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-45462","description":"Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher","exploit_maturity":"No public exploit","published":"2022-11-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-45047","description":"Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD \u003c= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.","exploit_maturity":"Proof of concept only","published":"2022-11-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-45400","description":"Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-11-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-45397","description":"Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-11-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-45396","description":"Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-11-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-45395","description":"Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-11-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-42122","description":"A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.","exploit_maturity":"No public exploit","published":"2022-11-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-42120","description":"A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.","exploit_maturity":"No public exploit","published":"2022-11-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-45378","description":"In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might even lead to arbitrary remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","exploit_maturity":"No public exploit","published":"2022-11-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-45136","description":"Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a result an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server. Apache Jena SDB has been EOL since December 2020 and users should migrate to alternative options e.g. Apache Jena TDB 2.","exploit_maturity":"No public exploit","published":"2022-11-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-42920","description":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","exploit_maturity":"No public exploit","published":"2022-11-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-37865","description":"With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the \"zip\", \"jar\" or \"war\" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse \"upwards\" using \"..\" sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.","exploit_maturity":"No public exploit","published":"2022-11-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-42468","description":"Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.","exploit_maturity":"No public exploit","published":"2022-10-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-39312","description":"Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue.","exploit_maturity":"Proof of concept only","published":"2022-10-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-39428","description":"Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2022-10-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-39198","description":"A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.","exploit_maturity":"No public exploit","published":"2022-10-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-21587","description":"Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2022-10-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-42889","description":"Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is \"${prefix:name}\", where \"prefix\" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - \"script\" - execute expressions using the JVM script execution engine (javax.script) - \"dns\" - resolve dns records - \"url\" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.","exploit_maturity":"Working exploit published","published":"2022-10-13","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-24697","description":"Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.","exploit_maturity":"Forecast only","published":"2022-10-13","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-41853","description":"Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property \"hsqldb.method_class_names\" to classes which are allowed to be called. For example, System.setProperty(\"hsqldb.method_class_names\", \"abc\") or Java argument -Dhsqldb.method_class_names=\"abc\" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.","exploit_maturity":"No public exploit","published":"2022-10-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-40929","description":"XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).","exploit_maturity":"Proof of concept only","published":"2022-09-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-39243","description":"NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.","exploit_maturity":"Proof of concept only","published":"2022-09-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-36944","description":"Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.","exploit_maturity":"Proof of concept only","published":"2022-09-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-41241","description":"Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-09-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-41226","description":"Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-09-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-39135","description":"Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.","exploit_maturity":"No public exploit","published":"2022-09-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-37021","description":"Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify \"--J=-Dgeode.enableGlobalSerialFilter=true\" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the \"serializable-object-filter\" configuration option. Using a global serial filter will impact performance.","exploit_maturity":"No public exploit","published":"2022-08-31","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-37223","description":"JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.","exploit_maturity":"No public exploit","published":"2022-08-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-37199","description":"JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.","exploit_maturity":"No public exploit","published":"2022-08-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-36599","description":"Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.","exploit_maturity":"No public exploit","published":"2022-08-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-36272","description":"Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.","exploit_maturity":"No public exploit","published":"2022-08-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-34115","description":"DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.","exploit_maturity":"No public exploit","published":"2022-07-22","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2015-8031","description":"Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks.","exploit_maturity":"No public exploit","published":"2022-07-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-32533","description":"Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option \"xss.filter.post = true\" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue","exploit_maturity":"No public exploit","published":"2022-07-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-41411","description":"drools \u003c=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.","exploit_maturity":"No public exploit","published":"2022-06-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-25845","description":"The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).","exploit_maturity":"Proof of concept only","published":"2022-06-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-30500","description":"Jfinal cms 5.1.0 is vulnerable to SQL Injection.","exploit_maturity":"No public exploit","published":"2022-05-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-23792","description":"The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered.","exploit_maturity":"No public exploit","published":"2022-05-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-28890","description":"A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.","exploit_maturity":"No public exploit","published":"2022-05-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-28111","description":"MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the orderBy parameter.","exploit_maturity":"No public exploit","published":"2022-05-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-25842","description":"All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.","exploit_maturity":"No public exploit","published":"2022-05-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-25767","description":"All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a malicious database server, causing arbitrary file read and deserialization of local gadgets.","exploit_maturity":"No public exploit","published":"2022-05-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-24881","description":"Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but input verification is not done. The fault is rectified in version 1.0.0.beta.2.","exploit_maturity":"Proof of concept only","published":"2022-04-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-23457","description":"ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.","exploit_maturity":"Proof of concept only","published":"2022-04-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-0272","description":"Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.","exploit_maturity":"No public exploit","published":"2022-04-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-21445","description":"Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces).  Supported versions that are affected are 12.2.1.3.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF).  Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2022-04-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-26612","description":"In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3","exploit_maturity":"No public exploit","published":"2022-04-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-26585","description":"Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.","exploit_maturity":"Working exploit published","published":"2022-04-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-22965","description":"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.","exploit_maturity":"Exploited in the wild","published":"2022-04-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-22963","description":"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","exploit_maturity":"Exploited in the wild","published":"2022-04-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-43142","description":"An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput.","exploit_maturity":"No public exploit","published":"2022-03-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-43090","description":"An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.","exploit_maturity":"No public exploit","published":"2022-03-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-25312","description":"An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions \u003c 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Any23 2.7.","exploit_maturity":"No public exploit","published":"2022-03-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-0839","description":"Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.","exploit_maturity":"No public exploit","published":"2022-03-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-23899","description":"MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.","exploit_maturity":"No public exploit","published":"2022-03-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-23898","description":"MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.","exploit_maturity":"Working exploit published","published":"2022-03-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-0265","description":"Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.","exploit_maturity":"Proof of concept only","published":"2022-03-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-23640","description":"Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no known workaround.","exploit_maturity":"No public exploit","published":"2022-03-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-42767","description":"A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.","exploit_maturity":"No public exploit","published":"2022-03-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-44868","description":"A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do","exploit_maturity":"No public exploit","published":"2022-02-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-22881","description":"Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData.","exploit_maturity":"No public exploit","published":"2022-02-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-22880","description":"Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.","exploit_maturity":"No public exploit","published":"2022-02-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-44521","description":"When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.","exploit_maturity":"Working exploit published","published":"2022-02-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-46089","description":"In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.","exploit_maturity":"No public exploit","published":"2022-01-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-23221","description":"H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.","exploit_maturity":"Proof of concept only","published":"2022-01-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-21306","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2022-01-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-35587","description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2022-01-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-23305","description":"By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.","exploit_maturity":"Proof of concept only","published":"2022-01-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-0239","description":"corenlp is vulnerable to Improper Restriction of XML External Entity Reference","exploit_maturity":"Proof of concept only","published":"2022-01-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-43297","description":"A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.","exploit_maturity":"Proof of concept only","published":"2022-01-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-45456","description":"Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.","exploit_maturity":"Forecast only","published":"2022-01-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-31522","description":"Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.","exploit_maturity":"No public exploit","published":"2022-01-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-40525","description":"Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.","exploit_maturity":"No public exploit","published":"2022-01-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-44548","description":"An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.","exploit_maturity":"No public exploit","published":"2021-12-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-43113","description":"iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.","exploit_maturity":"No public exploit","published":"2021-12-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-45046","description":"It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.","exploit_maturity":"Exploited in the wild","published":"2021-12-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-44228","description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","exploit_maturity":"Exploited in the wild","published":"2021-12-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-23463","description":"The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.","exploit_maturity":"No public exploit","published":"2021-12-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21692","description":"FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21690","description":"Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-40865","description":"An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4","exploit_maturity":"Proof of concept only","published":"2021-10-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-38294","description":"A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.","exploit_maturity":"Forecast only","published":"2021-10-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-42575","description":"The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.","exploit_maturity":"No public exploit","published":"2021-10-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-3878","description":"corenlp is vulnerable to Improper Restriction of XML External Entity Reference","exploit_maturity":"No public exploit","published":"2021-10-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-42013","description":"It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.","exploit_maturity":"Exploited in the wild","published":"2021-10-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-41773","description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","exploit_maturity":"Exploited in the wild","published":"2021-10-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-41616","description":"Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was insecure and used ObjectInputStream.readObject without validating that the input data was safe to deserialize. Please note that DdlUtils is no longer being actively developed. To address the insecurity of the BinaryObjectHelper class, the following changes to DdlUtils have been made: (1) BinaryObjectsHelper.java has been deleted from the DdlUtils source repository and the DdlUtils feature of propagating data of SQL binary types is therefore no longer present in DdlUtils; (2) The ddlutils-1.0 release has been removed from the Apache Release Distribution Infrastructure; (3) The DdlUtils web site has been updated to indicate that DdlUtils is now available only as source code, not as a packaged release.","exploit_maturity":"No public exploit","published":"2021-09-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-21125","description":"An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.","exploit_maturity":"No public exploit","published":"2021-09-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-38555","description":"An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions \u003c 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.","exploit_maturity":"No public exploit","published":"2021-09-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-37579","description":"The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.","exploit_maturity":"No public exploit","published":"2021-09-09","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-36163","description":"In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1","exploit_maturity":"No public exploit","published":"2021-09-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-10095","description":"bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.","exploit_maturity":"No public exploit","published":"2021-09-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-34371","description":"Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.","exploit_maturity":"Proof of concept only","published":"2021-08-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-37578","description":"Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicious serialized object to the above RMI entries. The objects get deserialized without any check on the incoming data. In the worst case, it may let the attacker run arbitrary code remotely. For both jUDDI web service applications and jUDDI clients, the usage of RMI is disabled by default. Since this is an optional feature and an extension to the UDDI protocol, the likelihood of impact is low. Starting with 3.3.10, all RMI related code was removed.","exploit_maturity":"No public exploit","published":"2021-07-29","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-2394","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2021-07-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-29485","description":"Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE) via a maliciously crafted Java deserialization gadget chain leveraged against the Ratpack session store. If one's application does not use Ratpack's session mechanism, it is not vulnerable. Ratpack 1.9.0 introduces a strict allow-list mechanism that mitigates this vulnerability when used. Two possible workarounds exist. The simplest mitigation for users of earlier versions is to reduce the likelihood of attackers being able to write to the session data store. Alternatively or additionally, the allow-list mechanism could be manually back ported by providing an alternative implementation of `SessionSerializer` that uses an allow-list.","exploit_maturity":"No public exploit","published":"2021-06-29","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-31649","description":"In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute","exploit_maturity":"No public exploit","published":"2021-06-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21669","description":"Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2021-06-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-9493","description":"A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.","exploit_maturity":"No public exploit","published":"2021-06-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-30179","description":"Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.","exploit_maturity":"No public exploit","published":"2021-06-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-25641","description":"Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.","exploit_maturity":"Proof of concept only","published":"2021-06-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21658","description":"Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2021-05-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-2135","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2021-04-22","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-27850","description":"A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.","exploit_maturity":"Working exploit published","published":"2021-04-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21350","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"No public exploit","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21347","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"No public exploit","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21345","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"Working exploit published","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21344","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"Forecast only","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21342","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"No public exploit","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-26987","description":"Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.","exploit_maturity":"No public exploit","published":"2021-03-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-36282","description":"JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.","exploit_maturity":"No public exploit","published":"2021-03-12","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21479","description":"In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.","exploit_maturity":"Working exploit published","published":"2021-02-09","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-23262","description":"An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.","exploit_maturity":"No public exploit","published":"2021-01-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-23901","description":"An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions \u003c 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Nutch 1.18.","exploit_maturity":"No public exploit","published":"2021-01-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-8570","description":"Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.","exploit_maturity":"No public exploit","published":"2021-01-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-1994","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2021-01-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-14756","description":"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2021-01-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-23926","description":"The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.","exploit_maturity":"No public exploit","published":"2021-01-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-23899","description":"OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.","exploit_maturity":"No public exploit","published":"2021-01-13","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-11995","description":"A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.","exploit_maturity":"No public exploit","published":"2021-01-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-17519","description":"A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.","exploit_maturity":"Exploited in the wild","published":"2021-01-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-11974","description":"In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.","exploit_maturity":"No public exploit","published":"2020-12-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-35476","description":"A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)","exploit_maturity":"Working exploit published","published":"2020-12-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-17530","description":"Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.","exploit_maturity":"Exploited in the wild","published":"2020-12-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-17531","description":"A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the \"sp\" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.","exploit_maturity":"No public exploit","published":"2020-12-08","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-15681","description":"In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE.","exploit_maturity":"No public exploit","published":"2020-11-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-14750","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2020-11-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-14882","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2020-10-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-14859","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2020-10-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-14841","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Forecast only","published":"2020-10-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-17640","description":"In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.","exploit_maturity":"No public exploit","published":"2020-10-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-15232","description":"In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.","exploit_maturity":"No public exploit","published":"2020-10-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-0230","description":"Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.","exploit_maturity":"Working exploit published","published":"2020-09-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-11998","description":"A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html \"A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code.\" Mitigation: Upgrade to Apache ActiveMQ 5.15.13","exploit_maturity":"Forecast only","published":"2020-09-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-25020","description":"MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.","exploit_maturity":"No public exploit","published":"2020-08-29","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-13921","description":"**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.","exploit_maturity":"No public exploit","published":"2020-08-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-5413","description":"Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the \"deserialization gadgets\" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown \"deserialization gadgets\" when configuring Kryo in code.","exploit_maturity":"No public exploit","published":"2020-07-31","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-14645","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2020-07-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-14644","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2020-07-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-1948","description":"This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.","exploit_maturity":"Proof of concept only","published":"2020-07-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-13926","description":"Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.","exploit_maturity":"No public exploit","published":"2020-07-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-13925","description":"Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.","exploit_maturity":"Proof of concept only","published":"2020-07-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-4448","description":"IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 181228.","exploit_maturity":"No public exploit","published":"2020-06-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-21234","description":"Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.","exploit_maturity":"No public exploit","published":"2020-05-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-11973","description":"Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.","exploit_maturity":"No public exploit","published":"2020-05-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-11972","description":"Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.","exploit_maturity":"No public exploit","published":"2020-05-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-10683","description":"dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.","exploit_maturity":"No public exploit","published":"2020-05-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-1964","description":"It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).","exploit_maturity":"No public exploit","published":"2020-04-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-2915","description":"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching, CacheStore, Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2020-04-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-2883","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2020-04-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-17564","description":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","exploit_maturity":"Working exploit published","published":"2020-04-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-11024","description":"odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.","exploit_maturity":"No public exploit","published":"2020-03-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-11023","description":"odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.","exploit_maturity":"No public exploit","published":"2020-03-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-10991","description":"Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java","exploit_maturity":"No public exploit","published":"2020-03-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-7961","description":"Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).","exploit_maturity":"Exploited in the wild","published":"2020-03-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-1947","description":"In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security flaws of RCE.","exploit_maturity":"Proof of concept only","published":"2020-03-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-1938","description":"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","exploit_maturity":"Exploited in the wild","published":"2020-02-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-8441","description":"JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.","exploit_maturity":"No public exploit","published":"2020-02-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-17570","description":"An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.","exploit_maturity":"No public exploit","published":"2020-01-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-2555","description":"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2020-01-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-2551","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2020-01-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-2546","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Application Container - JavaEE). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2020-01-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-1000027","description":"Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.","exploit_maturity":"Proof of concept only","published":"2020-01-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-17571","description":"Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.","exploit_maturity":"Proof of concept only","published":"2019-12-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-19899","description":"Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature.","exploit_maturity":"No public exploit","published":"2019-12-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2014-3699","description":"eDeploy has RCE via cPickle deserialization of untrusted data","exploit_maturity":"No public exploit","published":"2019-12-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-17556","description":"Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.","exploit_maturity":"No public exploit","published":"2019-12-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-13116","description":"The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections","exploit_maturity":"No public exploit","published":"2019-10-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-16891","description":"Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.","exploit_maturity":"No public exploit","published":"2019-10-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-0195","description":"Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbol could be used to craft a Java deserialization attack, thus running malicious injected Java code. The vector would be the t:formdata parameter from the Form component.","exploit_maturity":"No public exploit","published":"2019-09-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-15563","description":"Observational Health Data Sciences and Informatics (OHDSI) WebAPI before 2.7.2 allows SQL injection in FeatureExtractionService.java.","exploit_maturity":"No public exploit","published":"2019-08-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-14379","description":"SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.","exploit_maturity":"No public exploit","published":"2019-07-29","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-11779","description":"In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.","exploit_maturity":"No public exploit","published":"2019-07-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-10173","description":"It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)","exploit_maturity":"Forecast only","published":"2019-07-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-11307","description":"An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.","exploit_maturity":"No public exploit","published":"2019-07-09","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-15890","description":"An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server.","exploit_maturity":"No public exploit","published":"2019-06-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-2729","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2019-06-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-4279","description":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.","exploit_maturity":"Working exploit published","published":"2019-05-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2013-7285","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","exploit_maturity":"Working exploit published","published":"2019-05-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-10309","description":"Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients.","exploit_maturity":"No public exploit","published":"2019-04-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-2725","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2019-04-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-2699","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL). The supported version that is affected is Java SE: 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. While the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2019-04-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-0228","description":"Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.","exploit_maturity":"No public exploit","published":"2019-04-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-11068","description":"libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.","exploit_maturity":"No public exploit","published":"2019-04-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-1003041","description":"A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.","exploit_maturity":"No public exploit","published":"2019-03-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-1003040","description":"A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.","exploit_maturity":"No public exploit","published":"2019-03-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-0192","description":"In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.","exploit_maturity":"Working exploit published","published":"2019-03-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-0187","description":"Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.","exploit_maturity":"No public exploit","published":"2019-03-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-9212","description":"SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget. NOTE: The vendor doesn’t consider this issue a vulnerability because the blacklist is being misused. SOFA Hessian supports custom blacklist and a disclaimer was posted encouraging users to update the blacklist or to use the whitelist feature for their specific needs since the blacklist is not being actively updated","exploit_maturity":"No public exploit","published":"2019-02-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-1003015","description":"An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried in preparation of job import to read arbitrary files, perform a denial of service attack, etc.","exploit_maturity":"No public exploit","published":"2019-02-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-3774","description":"Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.","exploit_maturity":"No public exploit","published":"2019-01-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-3773","description":"Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.","exploit_maturity":"No public exploit","published":"2019-01-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-3772","description":"Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.","exploit_maturity":"No public exploit","published":"2019-01-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-11788","description":"Apache Karaf provides a features deployer, which allows users to \"hot deploy\" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.","exploit_maturity":"Proof of concept only","published":"2019-01-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-5312","description":"An issue was discovered in weixin-java-tools v3.3.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. NOTE: this issue exists because of an incomplete fix for CVE-2018-20318.","exploit_maturity":"No public exploit","published":"2019-01-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-19362","description":"FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.","exploit_maturity":"No public exploit","published":"2019-01-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-19361","description":"FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.","exploit_maturity":"No public exploit","published":"2019-01-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-19360","description":"FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.","exploit_maturity":"No public exploit","published":"2019-01-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-14721","description":"FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.","exploit_maturity":"No public exploit","published":"2019-01-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-14720","description":"FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.","exploit_maturity":"No public exploit","published":"2019-01-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-14719","description":"FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.","exploit_maturity":"No public exploit","published":"2019-01-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-14718","description":"FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.","exploit_maturity":"No public exploit","published":"2019-01-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-20433","description":"c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.","exploit_maturity":"No public exploit","published":"2018-12-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1000844","description":"Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file system or to perform SSRF.. This vulnerability appears to have been fixed in After commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437.","exploit_maturity":"No public exploit","published":"2018-12-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1000836","description":"bw-calendar-engine version \u003c= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.","exploit_maturity":"No public exploit","published":"2018-12-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1000823","description":"exist version \u003c= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.","exploit_maturity":"No public exploit","published":"2018-12-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1000822","description":"codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via specially crafted GSA XML files. This vulnerability appears to have been fixed in after commit faa265b.","exploit_maturity":"No public exploit","published":"2018-12-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1000820","description":"neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c.","exploit_maturity":"No public exploit","published":"2018-12-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-20059","description":"jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.","exploit_maturity":"No public exploit","published":"2018-12-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1000861","description":"A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.","exploit_maturity":"Exploited in the wild","published":"2018-12-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1851","description":"IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization. By sending a specially-crafted request to the RP service, an attacker could exploit this vulnerability to execute arbitrary code. IBM X-Force ID: 150999.","exploit_maturity":"No public exploit","published":"2018-10-31","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-18628","description":"An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPO_SESSION field of a cookie. Sending this cookie may lead to remote code execution.","exploit_maturity":"No public exploit","published":"2018-10-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-3252","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2018-10-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-3245","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2018-10-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-3191","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2018-10-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-3183","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Scripting). Supported versions that are affected are Java SE: 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2018-10-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-18240","description":"Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.","exploit_maturity":"No public exploit","published":"2018-10-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-12544","description":"In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.","exploit_maturity":"No public exploit","published":"2018-10-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-12542","description":"In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.","exploit_maturity":"No public exploit","published":"2018-10-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-15531","description":"JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.","exploit_maturity":"No public exploit","published":"2018-09-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1000644","description":"Eclipse RDF4j version \u003c 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.","exploit_maturity":"No public exploit","published":"2018-08-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-8027","description":"Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.","exploit_maturity":"No public exploit","published":"2018-07-31","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-7464","description":"It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker could use this flaw to cause DoS, SSRF, or information disclosure if they are able to provide XML content for parsing.","exploit_maturity":"No public exploit","published":"2018-07-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-8018","description":"In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to GridClientJdkMarshaller deserialization endpoint.","exploit_maturity":"No public exploit","published":"2018-07-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-2938","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Java DB). Supported versions that are affected are Java SE: 6u191, 7u181 and 8u172. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. While the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVE-2018-2938 addresses CVE-2018-1313. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2018-07-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-2894","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2018-07-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-2893","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2018-07-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-12972","description":"An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input.","exploit_maturity":"No public exploit","published":"2018-06-29","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-7465","description":"It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause remote code execution if they are able to provide XSLT content for parsing. Doing a transform in JAXP requires the use of a 'javax.xml.transform.TransformerFactory'. If the FEATURE_SECURE_PROCESSING feature is set to 'true', it mitigates this vulnerability.","exploit_maturity":"No public exploit","published":"2018-06-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-3936","description":"OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output.","exploit_maturity":"No public exploit","published":"2018-06-13","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-3202","description":"The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.","exploit_maturity":"No public exploit","published":"2018-06-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-8013","description":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.","exploit_maturity":"No public exploit","published":"2018-05-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1309","description":"Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.","exploit_maturity":"No public exploit","published":"2018-05-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-9019","description":"SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list.php, /admin/dict.php, /admin/mails_templates.php, or /admin/website.php.","exploit_maturity":"No public exploit","published":"2018-05-22","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1260","description":"Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.","exploit_maturity":"No public exploit","published":"2018-05-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-2879","description":"Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. Note: Please refer to Doc ID \u003ca href=\"http://support.oracle.com/CSP/main/article?cmd=show\u0026type=NOT\u0026id=2386496.1\"\u003eMy Oracle Support Note 2386496.1 for instructions on how to address this issue. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2018-04-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-2739","description":"Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that are affected are 10.1.4.3.0, 11.1.2.3.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.0 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).","exploit_maturity":"No public exploit","published":"2018-04-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-2628","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2018-04-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1275","description":"Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.","exploit_maturity":"Forecast only","published":"2018-04-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1270","description":"Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.","exploit_maturity":"Proof of concept only","published":"2018-04-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1282","description":"This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.","exploit_maturity":"No public exploit","published":"2018-04-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1295","description":"In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.","exploit_maturity":"No public exploit","published":"2018-04-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-8088","description":"org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.","exploit_maturity":"No public exploit","published":"2018-03-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-15692","description":"In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the Geode locator, they may be able to cause remote code execution if certain classes are present on the classpath.","exploit_maturity":"No public exploit","published":"2018-02-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-7489","description":"FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.","exploit_maturity":"No public exploit","published":"2018-02-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-7318","description":"SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filter_order parameter.","exploit_maturity":"Working exploit published","published":"2018-02-22","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-7525","description":"A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.","exploit_maturity":"Proof of concept only","published":"2018-02-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-15095","description":"A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.","exploit_maturity":"No public exploit","published":"2018-02-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-1000353","description":"Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.","exploit_maturity":"Exploited in the wild","published":"2018-01-29","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-17485","description":"FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.","exploit_maturity":"No public exploit","published":"2018-01-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-8046","description":"Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.","exploit_maturity":"Working exploit published","published":"2018-01-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-1000487","description":"Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.","exploit_maturity":"No public exploit","published":"2018-01-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2014-3630","description":"XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.","exploit_maturity":"No public exploit","published":"2017-12-29","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-5641","description":"Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. Other, unknown types may also exhibit such behaviors. One vector in the Java standard library exists that allows an attacker to trigger possibly further exploitable Java deserialization of untrusted data. Other known vectors in third party libraries can be used to trigger remote code execution.","exploit_maturity":"No public exploit","published":"2017-12-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-15708","description":"In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.","exploit_maturity":"No public exploit","published":"2017-12-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-8045","description":"In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.","exploit_maturity":"No public exploit","published":"2017-11-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-1000190","description":"SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.","exploit_maturity":"No public exploit","published":"2017-11-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-12634","description":"The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.","exploit_maturity":"No public exploit","published":"2017-11-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-12633","description":"The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.","exploit_maturity":"No public exploit","published":"2017-11-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2015-7501","description":"Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.","exploit_maturity":"Working exploit published","published":"2017-11-09","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-5003","description":"The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an \u003cex:serializable\u003e element.","exploit_maturity":"No public exploit","published":"2017-10-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2014-3600","description":"XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.","exploit_maturity":"No public exploit","published":"2017-10-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2014-3579","description":"XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.","exploit_maturity":"No public exploit","published":"2017-10-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-5636","description":"In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.","exploit_maturity":"No public exploit","published":"2017-10-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-10285","description":"Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2017-10-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-12629","description":"Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.","exploit_maturity":"Working exploit published","published":"2017-10-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-8736","description":"Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.","exploit_maturity":"No public exploit","published":"2017-10-12","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-12149","description":"In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.","exploit_maturity":"Exploited in the wild","published":"2017-10-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-12620","description":"When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.","exploit_maturity":"No public exploit","published":"2017-10-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-12621","description":"During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a \"SYSTEM\" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.","exploit_maturity":"No public exploit","published":"2017-09-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-12611","description":"In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.","exploit_maturity":"Working exploit published","published":"2017-09-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-6795","description":"In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.","exploit_maturity":"No public exploit","published":"2017-09-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-6798","description":"In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application.","exploit_maturity":"No public exploit","published":"2017-07-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-7664","description":"Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.","exploit_maturity":"No public exploit","published":"2017-07-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-9791","description":"The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.","exploit_maturity":"Exploited in the wild","published":"2017-07-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-4000","description":"Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.","exploit_maturity":"No public exploit","published":"2017-07-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-7504","description":"HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server \u003c= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.","exploit_maturity":"Working exploit published","published":"2017-05-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-7503","description":"It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.","exploit_maturity":"No public exploit","published":"2017-05-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-3549","description":"Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"Working exploit published","published":"2017-04-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-2173","description":"org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.","exploit_maturity":"No public exploit","published":"2017-04-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-5645","description":"In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","exploit_maturity":"Working exploit published","published":"2017-04-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-8735","description":"Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","exploit_maturity":"Exploited in the wild","published":"2017-04-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-6809","description":"Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.","exploit_maturity":"No public exploit","published":"2017-04-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-8749","description":"Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.","exploit_maturity":"No public exploit","published":"2017-03-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-8027","description":"SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to alter a SQL query, which can result in disclosure of information within the database or impersonation of an agent without authentication via a specially crafted HTTP post.","exploit_maturity":"No public exploit","published":"2017-03-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-5929","description":"QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.","exploit_maturity":"No public exploit","published":"2017-03-13","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-5638","description":"The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.","exploit_maturity":"Exploited in the wild","published":"2017-03-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-3159","description":"Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.","exploit_maturity":"No public exploit","published":"2017-03-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-3248","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).","exploit_maturity":"Working exploit published","published":"2017-01-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-3241","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).","exploit_maturity":"Working exploit published","published":"2017-01-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-1000031","description":"Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution","exploit_maturity":"No public exploit","published":"2016-10-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-5019","description":"CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string.","exploit_maturity":"No public exploit","published":"2016-10-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-6330","description":"The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.","exploit_maturity":"No public exploit","published":"2016-09-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-4999","description":"SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.","exploit_maturity":"No public exploit","published":"2016-08-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-3737","description":"The server in Red Hat JBoss Operations Network (JON) before 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization.","exploit_maturity":"No public exploit","published":"2016-08-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-3510","description":"Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-3586.","exploit_maturity":"Working exploit published","published":"2016-07-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-3720","description":"XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.","exploit_maturity":"No public exploit","published":"2016-06-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-0638","description":"Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.","exploit_maturity":"Proof of concept only","published":"2016-04-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-0788","description":"The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.","exploit_maturity":"No public exploit","published":"2016-04-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2015-5254","description":"Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.","exploit_maturity":"Proof of concept only","published":"2016-01-08","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2015-7450","description":"Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.","exploit_maturity":"Exploited in the wild","published":"2016-01-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2015-8103","description":"The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the \"Groovy variant in 'ysoserial'\".","exploit_maturity":"Working exploit published","published":"2015-11-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2015-4852","description":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.","exploit_maturity":"Exploited in the wild","published":"2015-11-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2012-3152","description":"Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component.  NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions.  NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.","exploit_maturity":"Exploited in the wild","published":"2012-10-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2010-2076","description":"Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.","exploit_maturity":"No public exploit","published":"2010-08-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"}
]