[
  {"cve_id":"CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.","exploit_maturity":"Proof of concept only","published":"2026-09-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-87822","description":"t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.","exploit_maturity":"No public exploit","published":"2026-09-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-86404","description":"EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.","exploit_maturity":"No public exploit","published":"2026-09-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-78254","description":"The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. \n\n\n\n\nIn order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks.\n\n\n\n\nFor ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.\n\n\n\n\nStarting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the  old behavior is required by existing build files.\n\n\n\n\nMitigations:\n\n\n\n\nUsers of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible.\n\n\n\n\nAll users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.","exploit_maturity":"No public exploit","published":"2026-09-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-52691","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive Metastore Module. \n\n\n\nThis issue affects Apache Griffin Hive Metastore Module: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","exploit_maturity":"No public exploit","published":"2026-09-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-84675","description":"OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.","exploit_maturity":"No public exploit","published":"2026-09-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-84670","description":"Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.","exploit_maturity":"No public exploit","published":"2026-09-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-84669","description":"A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system.","exploit_maturity":"No public exploit","published":"2026-09-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-84650","description":"In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.","exploit_maturity":"No public exploit","published":"2026-09-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-17615","description":"A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.","exploit_maturity":"No public exploit","published":"2026-08-31","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-55848","description":"mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.","exploit_maturity":"Proof of concept only","published":"2026-08-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-55673","description":"PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping. Attacker-controlled values reaching UnixLocalCommandExecutor.execute, WindowsLocalCommandExecutor.execute, LocalComputationManager.execute, ParallelLoadFlowActionSimulator.run, ActionSimulatorTool.run, AmplModelRunner.run, or AmplModelRunner.runAsync can break out of the intended command and execute arbitrary shell commands as the JVM user. The affected itools paths include action-simulator with task-count, security-analysis with external, and dynamic-security-analysis. Downstream CLI tools, libraries, REST front ends, and multi-tenant grid-analysis services that forward less-trusted contingency identifiers or computation parameters into these APIs can expose the injection remotely. This issue is fixed in version 7.2.2.","exploit_maturity":"No public exploit","published":"2026-08-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-55552","description":"Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.","exploit_maturity":"No public exploit","published":"2026-08-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-54550","description":"IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without normalizing parent-directory segments or enforcing destination containment. A malicious installer pack entry containing ../ sequences can therefore write outside the intended installation directory to startup folders, executable search paths, or other locations accessible with the victim's privileges when the victim runs the installer.","exploit_maturity":"Proof of concept only","published":"2026-08-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-66907","description":"Relative path traversal vulnerability in Apache Camel Google Storage component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0.\n\n\n\nThe camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when the downloadFileName option is set. That option is documented as a folder or a filename, and when its value contains no expression token the consumer builds the local destination by appending the object name to it: evaluateFileExpression sets the Exchange file-name header to the remote object name and evaluates downloadFileName + \"/${file:name}\". The ${file:name} token returns the file-name header verbatim, unlike ${file:onlyname}, which applies FileUtil.stripPath to it. The resulting string was passed directly to new File(result) and blob.downloadTo(file.toPath()) with no lexical normalization and no check that the destination stayed inside the configured directory. The object name is not route-controlled data: the consumer lists the bucket, iterates every returned blob and creates one exchange per object from blob.getBlobId().getName() verbatim, and the filter option that could restrict those names is not applied at all unless it has been explicitly set. Google Cloud Storage object names are opaque UTF-8 keys that the service stores and lists exactly as written, with no server-side canonicalization, and a forward slash is only a display convention for pseudo-directories, so a key containing parent-directory segments survives round-tripping intact. An object name containing such segments therefore resolved to a location outside the configured downloadFileName directory, letting anyone able to influence the names present in the consumed bucket cause Camel to create or overwrite a file at a location of their choosing, with the privileges of the Camel process. Depending on what the process can write to, overwriting a file outside the download directory can escalate beyond the loss of integrity of that file. The downloadFileName option is an ordinary consumer parameter and carries no security marker, so nothing signalled to users that its value was not being enforced as a containment boundary. The defect is consumer-only; the producer has no download-to-file sink. Camel's other file-download consumers - camel-file, camel-ftp, camel-smb, camel-mina-sftp, camel-azure-files and the Azure Storage download paths - already constrained their local downloads to the configured directory using a path-segment boundary check; camel-google-storage was the remaining object-store download sink not covered by that work.\n\n\n\nUsers are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, set the filter option to a regular expression that accepts only simple single-segment object names, so that any name carrying a path separator or a parent-directory segment is excluded before an exchange is created; note that no filtering whatsoever is applied when the option is left unset, and that the expression is matched against the whole object name. Alternatively, give downloadFileName an explicit expression that does not carry the remote path through, for example one built on ${file:onlyname} rather than the implicit ${file:name}, keeping in mind that a downloadFileName containing an expression is treated as route-author-controlled and is not covered by the containment check added in the fix. As defence in depth, treat the object names in any externally writable bucket as untrusted input and do not derive local filesystem paths from them.","exploit_maturity":"No public exploit","published":"2026-08-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-63490","description":"Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3.","exploit_maturity":"Proof of concept only","published":"2026-08-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-63337","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill, setJavaReturnType, and computeReturnTypeAsJavaClass to Class.forName(javaReturnType) with initialization enabled. An attacker able to answer the JsonRpcClient request through a shared broker or network interception can select a class already present in the victim JVM and trigger its static initializer, while JsonRpcClient.java later passes getReturnType output to mapper.parse and may also create type confusion. Successful exploitation can affect confidentiality, integrity, and availability in the client process. This issue is fixed in version 5.33.0.","exploit_maturity":"Proof of concept only","published":"2026-08-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-66256","description":"** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig.\n\nThis issue affects Apache Shindig: all versions.\n\nUsers with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","exploit_maturity":"No public exploit","published":"2026-08-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-15555","description":"A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.","exploit_maturity":"No public exploit","published":"2026-08-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-65432","description":"Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any \u003cwsdl:import\u003e or \u003cxsd:import\u003e referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","exploit_maturity":"No public exploit","published":"2026-08-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-3415","description":"The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.\n\nSuccessful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.","exploit_maturity":"No public exploit","published":"2026-08-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-70448","description":"Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy report files.","exploit_maturity":"No public exploit","published":"2026-08-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-46581","description":"In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.","exploit_maturity":"No public exploit","published":"2026-08-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-67340","description":"ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.","exploit_maturity":"No public exploit","published":"2026-08-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-62391","description":"The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases.\n\nThis issue affects Apache Kyuubi: from 1.6.0 before 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2026-07-31","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-11536","description":"IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.","exploit_maturity":"No public exploit","published":"2026-07-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-54079","description":"veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.","exploit_maturity":"No public exploit","published":"2026-07-29","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-54078","description":"veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRichTextStringOrStreamEntryStringRepresentation(), where a crafted PDF containing a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report. This issue is fixed in versions 1.30.2 and 1.31.71.","exploit_maturity":"No public exploit","published":"2026-07-29","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-15280","description":"IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.","exploit_maturity":"No public exploit","published":"2026-07-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-56817","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","exploit_maturity":"No public exploit","published":"2026-07-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-56623","description":"Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nA git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows.\n\n\n\n\nApplications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected.\n\n\n\n\nUsers are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue.\n\n\n\n\nThe issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5.","exploit_maturity":"No public exploit","published":"2026-07-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-56452","description":"Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nThe implementation of receiving files or directories via SCP did not validate filenames in SCP \"C\" or \"D\" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places.\n\n\n\n\nThe issue affects only\n\n  *  applications that use no longer supported Apache MINA SSHD versions \u003c 2.0.0 and use the SCP functions to receive files,\n  *  or applications using sshd-scp in Apache MINA SSHD \u003e= 2.0.0 to receive files.\n\n\n\n\nApplications using Apache MINA SSHD \u003e= 2.0.0 not using sshd-scp are not affected.\n\n\n\n\nThe issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.","exploit_maturity":"No public exploit","published":"2026-07-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-62238","description":"OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.","exploit_maturity":"Proof of concept only","published":"2026-07-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-55405","description":"LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to  1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL context and inject arbitrary SQL into the statements executed by the stores' search and removeAll(Filter) operations, enabling blind data exfiltration, denial of service via sleep functions, and deletion of arbitrary rows through removeAll(Filter). This issue is fixed in langchain4j-mariadb and langchain4j-pgvector versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26.","exploit_maturity":"No public exploit","published":"2026-07-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-55175","description":"Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.","exploit_maturity":"No public exploit","published":"2026-07-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-44795","description":"Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.","exploit_maturity":"No public exploit","published":"2026-07-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-55760","description":"Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader are vulnerable to path traversal, allowing arbitrary file read through template names derived from URL path parameters, request parameters, or other user-controlled sources. This issue is fixed in version 4.5.2.","exploit_maturity":"No public exploit","published":"2026-07-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-55471","description":"HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.","exploit_maturity":"Proof of concept only","published":"2026-07-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-46590","description":"Deserialization of Untrusted Data vulnerability in Apache Camel PQC component.\n\nThe camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadata back from the configured secret backend by deserializing a Base64-wrapped value with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. The same unfiltered legacy-migration read also remained in FileBasedKeyLifecycleManager (for the stored KeyPair and KeyMetadata). A principal who can write to the operator-controlled backend that holds these values - the HashiCorp Vault KV path, or the AWS Secrets Manager secret (requiring a Vault token or secretsmanager:PutSecretValue) - could store a crafted serialized object that is deserialized during normal key-lifecycle operations, potentially leading to code execution in the context of the application that manages the keys. This is an incomplete-remediation follow-on to CVE-2026-40048 (CAMEL-23200), which changed FileBasedKeyLifecycleManager to store metadata as JSON / PKCS#8 / X.509 but did not add an ObjectInputFilter, did not cover the Vault and AWS sibling managers, and left FileBasedKeyLifecycleManager's own legacy-migration deserialization unfiltered.\nThis issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, restrict write access to the key backend so that only the application's own identity can write the camel-pqc secrets (least-privilege HashiCorp Vault policies and secretsmanager:PutSecretValue IAM), and keep the PQC key material in a backend separate from any data that less-trusted principals can write.","exploit_maturity":"No public exploit","published":"2026-07-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-43866","description":"Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component.\n\nJmsBinding.extractBodyFromJms() in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject() whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer. The CVE-2026-40860 hardening added a post-deserialization class check that rejects classes outside the default allow-list java.**;javax.**;org.apache.camel.**;!*. However org.apache.camel.support.DefaultExchangeHolder itself lives in the allow-listed org.apache.camel.** namespace, so an ObjectMessage whose top-level object is a DefaultExchangeHolder passes the check. The receiving side then calls DefaultExchangeHolder.unmarshal() on it without requiring the transferExchange option to be enabled - an asymmetric trust boundary, since the sending side gates ObjectMessage and transferExchange handling but the receiving side did not - writing every non-null field of the holder into the Exchange: the message body, the IN and OUT headers, the exchange properties, the variables, the exchange id and the exception. An attacker who can publish an ObjectMessage to a queue or topic consumed by an affected Camel application can therefore inject arbitrary Exchange state using only universally-trusted java.lang and java.util types, with no deserialization gadget chain required, to manipulate routing and headers, exchange properties and error handling. The same handling applies to camel-sjms and camel-sjms2, and to the JMS-family components built on JmsComponent and JmsBinding: camel-amqp, camel-activemq and camel-activemq6. This is a bypass of the CVE-2026-40860 fix rather than a flaw in it.\nThis issue affects Apache Camel: from 3.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0; Apache Camel: from 3.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, JMS ObjectMessage handling is disabled by default in camel-jms, camel-sjms and the JMS-family components (a new objectMessageEnabled option defaults to false at the component and endpoint level), so an incoming ObjectMessage - including a DefaultExchangeHolder payload - is no longer deserialized unless the option is explicitly enabled; only set objectMessageEnabled=true when the consumed JMS destination is fed exclusively by trusted producers. For deployments that cannot upgrade immediately, restrict publish access to the queues and topics consumed by Camel to trusted producers via JMS broker authorization, and do not expose JMS consumers that map ObjectMessage bodies to untrusted networks; a JMS-provider deserialization allow-list does not mitigate this specific bypass because the crafted payload uses only universally-trusted classes.","exploit_maturity":"No public exploit","published":"2026-07-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-43865","description":"Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component.\n\nThe camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no user-supplied HazelcastInstance, hazelcastConfigUri, or referenced Config bean is provided - neither Hazelcast's JavaSerializationFilterConfig nor a Camel-side ObjectInputFilter is configured, so objects received over the Hazelcast cluster protocol are deserialized inside Hazelcast's own serialization layer (ObjectInputStream.readObject) before Camel ever processes them. An attacker who can join or otherwise reach the Hazelcast cluster can publish a crafted serialized Java object that is then deserialized on every Camel node, resulting in remote code execution. The exposure is present by default and requires no opt-in endpoint configuration: any route using a hazelcast consumer (hazelcast-topic, hazelcast-queue, hazelcast-seda, hazelcast-map, hazelcast-multimap, hazelcast-replicatedmap, hazelcast-list, hazelcast-set), as well as the HazelcastAggregationRepository and HazelcastIdempotentRepository, is affected whenever the managed instance is created from Camel's default configuration.\nThis issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix makes Camel apply a default Hazelcast JavaSerializationFilterConfig (whitelisting the java., javax. and org.apache.camel. class-name prefixes and blacklisting java.net.) to instances it creates from its own default configuration, while leaving any user-supplied Config or HazelcastInstance untouched. For deployments that cannot upgrade immediately, configure a deserialization filter on the Hazelcast instance (Hazelcast JavaSerializationFilterConfig, or the JVM-wide system property -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!*) and enable Hazelcast cluster authentication and TLS to restrict who can reach the cluster.","exploit_maturity":"No public exploit","published":"2026-07-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-43825","description":"Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel\n\nVersions Affected:\n  before 3.0.0-M4 (libsvm document categorization module; introduced in\n  OPENNLP-1808 and only present on the 3.x line)\n\nDescription:\nSvmDoccatModel.deserialize(InputStream) reads an attacker-controlled\nstream with java.io.ObjectInputStream and calls readObject() without an\nObjectInputFilter installed. ObjectInputStream materialises every class\nreferenced in the stream before the resulting object is cast to\nSvmDoccatModel, so the cast that follows readObject() executes only\nafter the foreign object graph has already been deserialised in full.\n\nIf a Java deserialization gadget chain is available on the consumer's\nclasspath, a crafted payload supplied to\ndeserialize() executes arbitrary code in the JVM that loads it. Apache\nOpenNLP itself does not ship a known gadget chain, so the realistic\nrisk is to downstream applications that embed the libsvm module\nalongside vulnerable transitive dependencies. The method is public and\nstatic, so any caller can pass an untrusted stream to it directly.\n\nThe practical impact is remote code execution against processes that\nload SvmDoccatModel instances from untrusted or semi-trusted origins.\n\nMitigation:\n\n3.x users should upgrade to 3.0.0-M4.\n\nUsers who cannot upgrade immediately should treat all serialized\nSvmDoccatModel streams as untrusted input unless their provenance is\nverified, and should avoid invoking SvmDoccatModel.deserialize() on\nstreams supplied by end users or fetched from third-party sources\nwithout integrity checks.","exploit_maturity":"No public exploit","published":"2026-07-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-42527","description":"Deserialization of Untrusted Data vulnerability in Apache Camel.\n\nThe default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**' variant in the aggregation-repository components) uses a recursive 'java.**' glob that admits classes whose hashCode/equals/readObject methods perform network I/O, notably java.net.URL and java.net.InetAddress. When an attacker can deliver a Java-serialized payload to an affected Camel consumer, deserialization of a HashMap (or any collection that calls hashCode on its elements) containing java.net.URL keys causes the JVM to issue DNS queries to the attacker-supplied host during the deserialization side-effect. The class-level filter check passes because the resulting object's class (HashMap) is allow-listed; the DNS query is observable on an attacker-controlled DNS server, providing an out-of-band side channel. The exposure is highest on the camel-jms family because JmsBinding.extractBodyFromJms invokes ObjectMessage.getObject() unconditionally when mapJmsMessage=true (default). Affected components: camel-jms, camel-sjms, camel-amqp, camel-mina, camel-netty, camel-netty-http, camel-vertx-http, camel-infinispan, and the aggregation repository components camel-leveldb, camel-cassandraql, camel-consul, camel-sql (JDBC aggregation repository).\nThis issue affects Apache Camel: from 4.14.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to a version that contains the CAMEL-23372 fix once available: 4.21.0 for the 4.21.x line, 4.18.3 for the 4.18.x line, and 4.14.8 for the 4.14.x line. For deployments that cannot upgrade immediately, configure a JMS-provider-side allow-list (Apache ActiveMQ Artemis 'deserializationAllowList' / 'deserializationDenyList', Apache ActiveMQ Classic 'org.apache.activemq.SERIALIZABLE_PACKAGES') as the primary mitigation, and/or override the in-code default via the endpoint-level 'deserializationFilter' option or the JVM-wide '-Djdk.serialFilter' system property with an explicit deny: '!java.net.**;java.**;javax.**;org.apache.camel.**;!*' (or '!java.net.**;java.**;org.apache.camel.**;!*' for the aggregation-repository components, which do not include javax.**).","exploit_maturity":"No public exploit","published":"2026-07-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-40859","description":"Deserialization of Untrusted Data vulnerability in Apache Camel.\n\nThe camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is reached only when the producer endpoint is configured with transferException=true (or the component-level allowJavaSerializedObject=true) and throwExceptionOnFailure is left at its default value of true; in that case a backend HTTP response with a 5xx status and the application/x-java-serialized-object content type has its body deserialized with no class restrictions. An attacker who controls the backend the Camel producer talks to - through a man-in-the-middle position on an unencrypted (plain HTTP) connection, or by compromising the backend service - can return a crafted serialized Java object and, if a suitable gadget chain is present on the classpath, achieve remote code execution on the Camel application host. The path is not reachable in the default configuration, where transferException is false.\nThis issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.20.0.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the deserialization performed by both helper utilities is constrained by a default ObjectInputFilter (allow-list java.**;javax.**;org.apache.camel.**;!*), which can be customised through the new deserializationFilter endpoint option or the JVM-wide -Djdk.serialFilter system property. For deployments that cannot upgrade immediately: do not enable transferException=true (or allowJavaSerializedObject=true) on producers that talk to untrusted or network-reachable backends; ensure producer connections use TLS (https) so that a response cannot be substituted by a man-in-the-middle; and, where the option is required, set an explicit -Djdk.serialFilter allow-list (for example java.**;org.apache.camel.**;!*) to constrain deserialization.","exploit_maturity":"No public exploit","published":"2026-07-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-55153","description":"mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize \"JavaBean\"-style properties, which for certain classes enables JNDI injection and \"deserialization gadgets.\" Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet \u003clink\u003e will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0.","exploit_maturity":"No public exploit","published":"2026-07-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-11595","description":"IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.","exploit_maturity":"No public exploit","published":"2026-06-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-57303","description":"Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.","exploit_maturity":"No public exploit","published":"2026-06-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-57296","description":"Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.","exploit_maturity":"No public exploit","published":"2026-06-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.","exploit_maturity":"No public exploit","published":"2026-06-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains \u003c), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before \u003c) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList\u003ccom.evil.Gadget\u003e when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.","exploit_maturity":"Proof of concept only","published":"2026-06-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-58175","description":"GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). This vulnerability requires that GeoServer is set up to use a proxy base URL and the `ENTITY_RESOLUTION_ALLOWLIST` (default since 2.25.0). Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash. If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability.","exploit_maturity":"No public exploit","published":"2026-06-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-27511","description":"GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.","exploit_maturity":"No public exploit","published":"2026-06-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-50645","description":"There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.","exploit_maturity":"No public exploit","published":"2026-06-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-50633","description":"A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","exploit_maturity":"No public exploit","published":"2026-06-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-50632","description":"A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.","exploit_maturity":"No public exploit","published":"2026-06-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-40998","description":"Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.","exploit_maturity":"No public exploit","published":"2026-06-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-40987","description":"A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.\n\nAffected versions:\nSpring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.","exploit_maturity":"No public exploit","published":"2026-06-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-53435","description":"In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards.\nThis can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.","exploit_maturity":"Proof of concept only","published":"2026-06-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-41732","description":"JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list.\n\nAffected versions:\nSpring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.","exploit_maturity":"No public exploit","published":"2026-06-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-41731","description":"JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types.\n\nAffected versions:\nSpring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.","exploit_maturity":"No public exploit","published":"2026-06-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-40993","description":"An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).\n\nAffected versions:\nSpring Security 7.0.0 through 7.0.5.","exploit_maturity":"No public exploit","published":"2026-06-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-41006","description":"Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.\n\nAffected versions:\nSpring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.","exploit_maturity":"No public exploit","published":"2026-06-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-9330","description":"IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.","exploit_maturity":"No public exploit","published":"2026-06-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-48827","description":"Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory.\n\n\n\n\nApplications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected.\n\n\n\n\nUsers are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue.\n\n\n\n\nThe issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4.\n\n\n\n\nWe would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.","exploit_maturity":"No public exploit","published":"2026-06-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-48977","description":"Relative Path Traversal vulnerability in Apache Ignite REST API.\n\nAuthenticated REST API users can read any file on the server with \"cmd=log\" command and a log path crafted in a certain way.\nThis issue affects Apache Ignite: from 2.0.0 through 2.17.0.\n\nUsers are recommended to upgrade to version 2.18.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2026-05-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-48922","description":"Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.","exploit_maturity":"No public exploit","published":"2026-05-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-2253","description":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.","exploit_maturity":"No public exploit","published":"2026-05-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-6009","description":"Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system","exploit_maturity":"No public exploit","published":"2026-05-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-42346","description":"Alkacon OpenCms before 16 allows XXE when the \u003c!DOCTYPE\u003e refers to an external host.","exploit_maturity":"Proof of concept only","published":"2026-05-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-42344","description":"Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.","exploit_maturity":"Working exploit published","published":"2026-05-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-40075","description":"OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the `/openmrs/moduleResources/{moduleid}` endpoint is vulnerable to a path traversal attack. The ModuleResourcesServlet constructs a filesystem path from user-controlled input without performing path boundary validation — the getFile() method concatenates the user-supplied path into an absolute filesystem path without calling normalize() or checking that the result stays within the allowed module resources directory. Because this endpoint serves static resources required for rendering the login page, it is not protected by authentication filters, allowing unauthenticated exploitation.\n\nAn attacker can traverse directories and read arbitrary files from the server filesystem, including /etc/passwd and application configuration files containing database credentials. Successful exploitation requires the target deployment to run on Apache Tomcat versions prior to 8.5.31, where the ..; path parameter bypass is not mitigated by the container. Deployments on Tomcat 8.5.31 or later and Tomcat 9.0.10 or later are protected at the container level, though the underlying code defect remains. This issue has been fixed in versions after 2.7.8 (within the 2.7.x branch) and in version 2.8.6 and later.","exploit_maturity":"Proof of concept only","published":"2026-05-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-42440","description":"OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader \n\nVersions Affected: \n\nbefore 1.9.5\nbefore 2.5.9\n\nbefore 3.0.0-M3 \n\nDescription:\n\n\nThe AbstractModelReader methods getOutcomes(), getOutcomePatterns(), and getPredicates() each read a 32-bit signed integer count field from a binary model stream and pass that value directly to an array allocation (new String[numOutcomes], new int[numOCTypes][], new String[NUM_PREDS]) without validating that the value is non-negative or within a reasonable bound. The count is therefore fully attacker-controlled when the model file originates from an untrusted source.\n\n\nA crafted .bin model file in which any of these count fields is set to Integer.MAX_VALUE (or any value large enough to exhaust the available heap) triggers an OutOfMemoryError at the array allocation itself, before the corresponding label or pattern data is consumed from the stream. The error occurs very early in deserialization: for a GIS model, getOutcomes() is reached after only the model-type string, the correction constant, and the correction parameter have been read; so the attacker pays no meaningful size cost to weaponize a payload, and a single small file can crash a JVM that loads it. Any code path that deserializes a .bin model is affected, including direct use of GenericModelReader and any higher-level component that delegates to it during model load.\n\n\nThe practical impact is denial of service against processes that load model files from untrusted or semi-trusted origins.  \n\n\nMitigation:\n\n\n\n  *  2.x users should upgrade to 2.5.9.\n\n  *  3.x users should upgrade to 3.0.0-M3.\n\n\n\n\nNote: The fix introduces an upper bound on each of the three count fields, checked before array allocation; counts that are negative or exceed the bound cause an IllegalArgumentException to be thrown and the read to fail fast with no large allocation. The default bound is 10,000,000, which is well above the entry counts of legitimate OpenNLP models but far below any value that would threaten heap exhaustion. Deployments that legitimately need to load models with more entries than the default can raise the limit at JVM startup by setting the OPENNLP_MAX_ENTRIES system property to the desired positive integer (e.g. -DOPENNLP_MAX_ENTRIES=50000000); invalid or non-positive values fall back to the default.\n\n\nUsers who cannot upgrade immediately should treat all .bin model files as untrusted input unless their provenance is verified, and should avoid loading models supplied by end users or fetched from third-party repositories without integrity checks.","exploit_maturity":"No public exploit","published":"2026-05-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-40978","description":"SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs.\n\nAffected versions:\nSpring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)","exploit_maturity":"No public exploit","published":"2026-04-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-40858","description":"The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a crafted serialized Java object that, when read during normal aggregation repository operations such as get or recover, results in arbitrary code execution in the context of the application.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.\n\nThe JIRA ticket:  https://issues.apache.org/jira/browse/CAMEL-23322  refers to the various commits that resolved the issue, and have more details. This issue follows the same class of vulnerability previously addressed in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747.","exploit_maturity":"No public exploit","published":"2026-04-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-40473","description":"The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput (for example via getBody(ObjectInput.class) or @Body ObjectInput), an attacker sending a crafted serialized Java object over the network to the MINA consumer port can trigger arbitrary code execution in the context of the application during readObject().\n\nThis issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.","exploit_maturity":"No public exploit","published":"2026-04-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-40048","description":"The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `\u003ckeyId\u003e.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.\n\nThis issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.","exploit_maturity":"No public exploit","published":"2026-04-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-27172","description":"The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs.\n\nThis issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1.\n\nUsers are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.","exploit_maturity":"No public exploit","published":"2026-04-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-6857","description":"A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.","exploit_maturity":"No public exploit","published":"2026-04-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-40882","description":"OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML external entity processing, which can lead to server-side file disclosure and SSRF. The target file must be less than 1023 characters. Version 1.22.0 fixes the issue.","exploit_maturity":"Proof of concept only","published":"2026-04-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-39973","description":"Apktool is a tool for reverse engineering Android APK files. In versions 3.0.0 and 3.0.1, a path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`). This is a security regression introduced in commit e10a045 (PR #4041, December 12, 2025), which removed the `BrutIO.sanitizePath()` call that previously prevented path traversal in resource file output paths. An attacker can embed `../` sequences in the `resources.arsc` Type String Pool to escape the output directory and write files to arbitrary locations, including `~/.ssh/config`, `~/.bashrc`, or Windows Startup folders, escalating to RCE. The fix in version 3.0.2 re-introduces `BrutIO.sanitizePath()` in `ResFileDecoder.java` before file write operations.","exploit_maturity":"No public exploit","published":"2026-04-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-22016","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and  21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"No public exploit","published":"2026-04-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-35582","description":"Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand() is vulnerable to OS command injection  because it interpolates temporary file paths into a /bin/sh -c shell command string without any escaping or input validation. The IN_FILE_ENDING and OUT_FILE_ENDING configuration keys flow directly into these paths, allowing a place author who can write or modify a .cfg file to inject arbitrary shell metacharacters that execute OS commands in the JVM process's security context. The framework already sanitizes placeName via an allowlist before embedding it in the same shell string, but applies no equivalent sanitization to file ending values. No runtime privileges beyond place configuration authorship, and no API or network access, are required to exploit this vulnerability. This is a framework-level defect with no safe mitigation available to downstream implementors, as Executrix provides neither escaping nor documented preconditions against metacharacters in file ending inputs. This issue has been fixed in version 8.43.0.","exploit_maturity":"Proof of concept only","published":"2026-04-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-35337","description":"Deserialization of Untrusted Data vulnerability in Apache Storm.\n\nVersions Affected:\nbefore 2.8.6.\n\n\nDescription:\nWhen processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the \"TGT\" credential field, leading to remote code execution in both the Nimbus and Worker JVMs.\n\n\nMitigation:\n2.x users should upgrade to 2.8.6.\n\n\nUsers who cannot upgrade immediately should monkey-patch an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket() restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies. A guide on how to do this is available in the release notes of 2.8.6.\n\nCredit: This issue was discovered by K.","exploit_maturity":"No public exploit","published":"2026-04-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-40180","description":"Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as new File(toOutputDir, entry.getName()) and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., ../../malicious.java) would write files outside the target directory. This vulnerability is fixed in 2.16.0 and 2.15.0-lts.","exploit_maturity":"Proof of concept only","published":"2026-04-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-35581","description":"Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass through into /bin/sh -c command execution. This vulnerability is fixed in 8.39.0.","exploit_maturity":"No public exploit","published":"2026-04-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-35554","description":"A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics.\n\nWhen a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch—potentially destined for a different topic—reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer.\n\n\nData Confidentiality:\nMessages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic.\n\nData Integrity:\nConsumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data.\n\nThis issue affects Apache Kafka versions ≤ 3.9.1, ≤ 4.0.1, and  ≤ 4.1.1.\n\nKafka users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability.","exploit_maturity":"No public exploit","published":"2026-04-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-34197","description":"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.\n\nApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including\nBrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).\n\nAn authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.\nBecause Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().\n\n\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.\n\n\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue","exploit_maturity":"Exploited in the wild","published":"2026-04-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-70952","description":"pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.","exploit_maturity":"Proof of concept only","published":"2026-03-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-67030","description":"Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code","exploit_maturity":"No public exploit","published":"2026-03-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-33166","description":"Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report. Version 2.38.0 fixes the issue.","exploit_maturity":"Proof of concept only","published":"2026-03-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-33001","description":"Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins.\nThis can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.","exploit_maturity":"No public exploit","published":"2026-03-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-22730","description":"A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands.\n\nThe vulnerability exists due to missing input sanitization.","exploit_maturity":"No public exploit","published":"2026-03-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-54920","description":"This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue.\n\n\n\n\n\nSummary\n\nApache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson deserialization of event log data. This allows an attacker with access to the Spark event logs directory to inject malicious JSON payloads that trigger deserialization of arbitrary classes, enabling command execution on the host running the Spark History Server.\n\n\n\n\n\nDetails\n\nThe vulnerability arises because the Spark History Server uses Jackson polymorphic deserialization with @JsonTypeInfo.Id.CLASS on SparkListenerEvent objects, allowing an attacker to specify arbitrary class names in the event JSON. This behavior permits instantiating unintended classes, such as org.apache.hive.jdbc.HiveConnection, which can perform network calls or other malicious actions during deserialization.\n\n\nThe attacker can exploit this by injecting crafted JSON content into the Spark event log files, which the History Server then deserializes on startup or when loading event logs. For example, the attacker can force the History Server to open a JDBC connection to a remote attacker-controlled server, demonstrating remote command injection capability.\n\n\n\n\n\n\nProof of Concept:\n\n1. Run Spark with event logging enabled, writing to a writable directory (spark-logs).\n\n2. Inject the following JSON at the beginning of an event log file:\n\n\n{\n\n  \"Event\": \"org.apache.hive.jdbc.HiveConnection\",\n  \"uri\": \"jdbc:hive2://\u003cIP\u003e:\u003cPORT\u003e/\",\n  \"info\": {\n    \"hive.metastore.uris\": \"thrift://\u003cIP\u003e:\u003cPORT\u003e\"\n  }\n}\n\n\n\n\n\n\n\n3. Start the Spark History Server with logs pointing to the modified directory.\n\n4. The Spark History Server initiates a JDBC connection to the attacker’s server, confirming the injection.\n\n\n\n\n\n\n\n\n\n\nImpact\n\nAn attacker with write access to Spark event logs can execute arbitrary code on the server running the History Server, potentially compromising the entire system.","exploit_maturity":"No public exploit","published":"2026-03-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-27830","description":"c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map\u003cString,Map\u003cString,String\u003e\u003e`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects \"indirectly serialized\" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.","exploit_maturity":"No public exploit","published":"2026-02-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-27727","description":"mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs.","exploit_maturity":"Proof of concept only","published":"2026-02-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-25747","description":"Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component.\n\nThe Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. An attacker who can write to the LevelDB database files used by a Camel application can inject a crafted serialized Java object that, when deserialized during normal aggregation repository operations, results in arbitrary code execution in the context of the application.\nThis issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.5, from 4.15.0 before 4.18.0.\n\nUsers are recommended to upgrade to version 4.18.0, which fixes the issue. For the 4.10.x LTS releases, users are recommended to upgrade to 4.10.9, while for 4.14.x LTS releases, users are recommended to upgrade to 4.14.5","exploit_maturity":"No public exploit","published":"2026-02-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-2818","description":"A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.","exploit_maturity":"No public exploit","published":"2026-02-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-14914","description":"IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.","exploit_maturity":"No public exploit","published":"2026-02-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-24400","description":"AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via \"Billion Laughs\" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.","exploit_maturity":"No public exploit","published":"2026-01-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-0603","description":"A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.","exploit_maturity":"No public exploit","published":"2026-01-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-29847","description":"A vulnerability in Apache Linkis.\n\nProblem Description\nWhen using the JDBC engine and da\nWhen using the JDBC engine and data source functionality, if the URL parameter configured on the frontend has undergone multiple rounds of URL encoding, it may bypass the system's checks. This bypass can trigger a vulnerability that allows unauthorized access to system files via JDBC parameters.\n\nScope of Impact\n\n\nThis issue affects Apache Linkis: from 1.3.0 through 1.7.0.\n\nSeverity level\n\n\nmoderate\nSolution\nContinuously check if the connection information contains the \"%\" character; if it does, perform URL decoding.\n\nUsers are recommended to upgrade to version 1.8.0, which fixes the issue.\n\n\n\n\nMore questions about this vulnerability can be discussed here:  https://lists.apache.org/list?dev@linkis.apache.org:2025-9:cve","exploit_maturity":"No public exploit","published":"2026-01-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-68493","description":"Missing XML Validation vulnerability in Apache Struts, Apache Struts.\n\nThis issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.\n\nUsers are recommended to upgrade to version 6.1.1, which fixes the issue.","exploit_maturity":"Working exploit published","published":"2026-01-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-66518","description":"Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config.\n\nThis issue affects Apache Kyuubi: from 1.6.0 through 1.10.2.\n\nUsers are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.","exploit_maturity":"No public exploit","published":"2026-01-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2026-21452","description":"MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation. The vulnerability enables a remote denial-of-service attack against applications that deserialize untrusted .msgpack model files using MessagePack for Java. A specially crafted but syntactically valid .msgpack file containing an EXT32 object with an attacker-controlled, excessively large payload length can trigger unbounded memory allocation during deserialization. When the model file is loaded, the library trusts the declared length metadata and attempts to allocate a byte array of that size, leading to rapid heap exhaustion, excessive garbage collection, or immediate JVM termination with an OutOfMemoryError. The attack requires no malformed bytes, user interaction, or elevated privileges and can be exploited remotely in real-world environments such as model registries, inference services, CI/CD pipelines, and cloud-based model hosting platforms that accept or fetch .msgpack artifacts. Because the malicious file is extremely small yet valid, it can bypass basic validation and scanning mechanisms, resulting in complete service unavailability and potential cascading failures in production systems. Version 0.9.11 fixes the vulnerability.","exploit_maturity":"Proof of concept only","published":"2026-01-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-66524","description":"Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. Unfiltered Java object deserialization does not provide protection against crafted state information stored in the cache server configured for GetAsanaObject. Exploitation requires an Apache NiFi system running with the GetAsanaObject Processor, and direct access to the configured cache server. Upgrading to Apache NiFi 2.7.0 is the recommended mitigation, which replaces Java Object serialization with JSON serialization. Removing the GetAsanaObject Processor located in the nifi-asana-processors-nar bundle also prevents exploitation.","exploit_maturity":"No public exploit","published":"2025-12-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-9121","description":"Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.","exploit_maturity":"No public exploit","published":"2025-12-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-26866","description":"A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks.\n\n\n\n\nUsers are recommended to upgrade to version 1.7.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2025-12-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-64518","description":"The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.","exploit_maturity":"No public exploit","published":"2025-11-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-64134","description":"Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2025-10-29","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-55752","description":"Relative Path Traversal vulnerability in Apache Tomcat.\n\nThe fix for bug 60013 introduced a regression where the       rewritten URL was normalized before it was decoded. This introduced the       possibility that, for rewrite rules that rewrite query parameters to the       URL, an attacker could manipulate the request URI to bypass security       constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.","exploit_maturity":"Proof of concept only","published":"2025-10-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-53066","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and  21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"No public exploit","published":"2025-10-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-59952","description":"MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources. This is fixed in version 8.6.0.","exploit_maturity":"No public exploit","published":"2025-09-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-10492","description":"A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library","exploit_maturity":"No public exploit","published":"2025-09-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-54385","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki#searchDocuments APIs pass queries directly to Hibernate without sanitization. Even when these APIs enforce a specific SELECT clause, attackers can still inject malicious code through HQL's native function support in other parts of the query (such as the WHERE clause). This is fixed in versions 16.10.6 and 17.3.0-rc-1.","exploit_maturity":"No public exploit","published":"2025-07-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-49656","description":"Users with administrator access can create databases files outside the files area of the Fuseki server.\n\nThis issue affects Apache Jena version up to 5.4.0.\n\nUsers are recommended to upgrade to version 5.5.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2025-07-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-53689","description":"Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit \u003c 2.23.2 due to usage of an unsecured document build to load privileges.\n\nUsers are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.","exploit_maturity":"No public exploit","published":"2025-07-14","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-52888","description":"Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). Version 2.34.1 contains a patch for the issue.","exploit_maturity":"Proof of concept only","published":"2025-06-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-47771","description":"PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in an InputStream and returns a SparseMatrix object. This issue has been patched in com.powsybl:powsybl-math: 6.7.2. A workaround for this issue involves not using SparseMatrix deserialization (SparseMatrix.read(...) methods).","exploit_maturity":"No public exploit","published":"2025-06-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-3594","description":"Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older unsupported versions allows remote attackers to (1) add files to arbitrary locations on the server and (2) download and execute arbitrary files from the download server via the `_com_liferay_server_admin_web_portlet_ServerAdminPortlet_jarName` parameter.","exploit_maturity":"No public exploit","published":"2025-06-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-27819","description":"In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.\n\n\nSince Apache Kafka 3.4.0, we have added a system property (\"-Dorg.apache.kafka.disallowed.login.modules\") to disable the problematic login modules usage in SASL JAAS configuration. Also by default \"com.sun.security.auth.module.JndiLoginModule\" is disabled in Apache Kafka 3.4.0, and \"com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule\" is disabled by default in in Apache Kafka 3.9.1/4.0.0","exploit_maturity":"No public exploit","published":"2025-06-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-27818","description":"A possible security vulnerability has been identified in Apache Kafka.\nThis requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config\nand a SASL-based security protocol, which has been possible on Kafka clusters since Apache Kafka 2.0.0 (Kafka Connect 2.3.0).\nWhen configuring the broker via config file or AlterConfig command, or connector via the Kafka Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config`\nproperty for any of the connector's Kafka clients to \"com.sun.security.auth.module.LdapLoginModule\", which can be done via the\n`producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties.\nThis will allow the server to connect to the attacker's LDAP server\nand deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.\nAttacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.\n\nSince Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box\nconfigurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector\nclient override policy that permits them.\n\nSince Apache Kafka 3.9.1/4.0.0, we have added a system property (\"-Dorg.apache.kafka.disallowed.login.modules\") to disable the problematic login modules usage\nin SASL JAAS configuration. Also by default \"com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule\" are disabled in Apache Kafka Connect 3.9.1/4.0.0. \n\nWe advise the Kafka users to validate connector configurations and only allow trusted LDAP configurations. Also examine connector dependencies for \nvulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally,\nin addition to leveraging the \"org.apache.kafka.disallowed.login.modules\" system property, Kafka Connect users can also implement their own connector\nclient config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.","exploit_maturity":"No public exploit","published":"2025-06-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-31650","description":"Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.","exploit_maturity":"Working exploit published","published":"2025-04-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-32968","description":"XWiki is a generic wiki platform. In versions starting from 1.6-milestone-1 to before 15.10.16, 16.4.6, and 16.10.1, it is possible for a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki. The protection added to this REST API is the same as the one used to validate complete select queries, making it more consistent. However, while the script API always had this protection for complete queries, it's important to note that it's a very strict protection and some valid, but complex, queries might suddenly require the author to have programming right.","exploit_maturity":"No public exploit","published":"2025-04-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-55238","description":"OpenMetadata \u003c=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query.","exploit_maturity":"Proof of concept only","published":"2025-04-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-21587","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE:8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:17.0.14, 21.0.6, 24; Oracle GraalVM Enterprise Edition:20.3.17 and  21.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"No public exploit","published":"2025-04-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-31487","description":"The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file's content in one of the returned JIRA fields (such as the summary or description for example). The vulnerability has been patched in the JIRA Extension v8.6.5.","exploit_maturity":"No public exploit","published":"2025-04-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-31129","description":"Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is fixed in 2.17.0 (2.x) and 3.7.0 (3.x).","exploit_maturity":"No public exploit","published":"2025-03-31","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-27553","description":"Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a 'resolveFile' method that\ntakes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of\nthe base file\". However, when the path contains encoded \"..\"\ncharacters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2025-03-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-6854","description":"In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.","exploit_maturity":"Proof of concept only","published":"2025-03-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-57606","description":"SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker to obtain sensitive information via the getTotalData component.","exploit_maturity":"Proof of concept only","published":"2025-02-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-52807","description":"The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag `( ]\u003e` could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML. A previous release provided an incomplete solution revealed by new testing. This issue has been patched as of version 1.7.4. No known workarounds are available.","exploit_maturity":"No public exploit","published":"2025-01-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-12744","description":"A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30.","exploit_maturity":"No public exploit","published":"2024-12-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-38819","description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.","exploit_maturity":"Working exploit published","published":"2024-12-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-55887","description":"Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. Release 1.0.9 of Ucum-java fixes this vulnerability. As a workaround, ensure that the source xml for instantiating UcumEssenceService is trusted.","exploit_maturity":"No public exploit","published":"2024-12-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-45761","description":"Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user could potentially exploit this vulnerability to load any web plugins or Java class leading to the possibility of altering the behavior of certain apps/OS or Denial of Service.","exploit_maturity":"No public exploit","published":"2024-12-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-41137","description":"Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.\n\nIn real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.","exploit_maturity":"No public exploit","published":"2024-12-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-21287","description":"Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Exploited in the wild","published":"2024-11-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-52007","description":"HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( \u003c!DOCTYPE foo [\u003c!ENTITY example SYSTEM \"/etc/passwd\"\u003e ]\u003e could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 \u0026 #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","exploit_maturity":"No public exploit","published":"2024-11-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-49760","description":"OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form `translations-$LANG.json`. But when doing so in versions prior to 3.8.3, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to read other JSON files on the file system. Version 3.8.3 addresses this issue.","exploit_maturity":"No public exploit","published":"2024-10-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-47881","description":"OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the `database` extension, the \"enable_load_extension\" property can be set for the SQLite integration, enabling an attacker to load (local or remote) extension DLLs and so run arbitrary code on the server. The attacker needs to have network access to the OpenRefine instance. Version 3.8.3 fixes this issue.","exploit_maturity":"Proof of concept only","published":"2024-10-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-28168","description":"Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.\n\nThis issue affects Apache XML Graphics FOP: 2.9.\n\nUsers are recommended to upgrade to version 2.10, which fixes the issue.","exploit_maturity":"No public exploit","published":"2024-10-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-45772","description":"Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.\n\nThis issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0.\nThe deprecated org.apache.lucene.replicator.http package is affected.\nThe org.apache.lucene.replicator.nrt package is not affected.\n\nUsers are recommended to upgrade to version 9.12.0, which fixes the issue.\n\n The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.","exploit_maturity":"No public exploit","published":"2024-09-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-46985","description":"DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1.","exploit_maturity":"No public exploit","published":"2024-09-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-38816","description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n\nSpecifically, an application is vulnerable when both of the following are true:\n\n  *  the web application uses RouterFunctions to serve static resources\n  *  resource handling is explicitly configured with a FileSystemResource location\n\n\nHowever, malicious requests are blocked and rejected when any of the following is true:\n\n  *  the  Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use\n  *  the application runs on Tomcat or Jetty","exploit_maturity":"Working exploit published","published":"2024-09-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-45294","description":"The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available.","exploit_maturity":"No public exploit","published":"2024-09-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-42468","description":"openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4.2.1 is susceptible to an unauthenticated path traversal vulnerability. Local files on the server can be requested via HTTP GET on the CometVisuServlet. This issue may lead to information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.","exploit_maturity":"No public exploit","published":"2024-08-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-43044","description":"Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.","exploit_maturity":"Proof of concept only","published":"2024-08-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-6960","description":"The H2O machine learning platform uses \"Iced\" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized (no class whitelist). An attacker can construct a crafted Iced model that uses Java gadgets and leads to arbitrary code execution when imported to the H2O platform.","exploit_maturity":"Proof of concept only","published":"2024-07-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-29737","description":"In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\n\nMitigation:\n\nall users should upgrade to 2.1.4\n\nBackground info:\n\nLog in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the \"Build Argument\". Note that there is no verification and interception of the special character \"`\". As a result, you will find that this injection command will be successfully executed after executing the build.\n\nIn the latest version, the special symbol ` is intercepted.","exploit_maturity":"No public exploit","published":"2024-07-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-52291","description":"In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\n\nBackground:\n\nIn the \"Project\" module, the maven build args  “\u003c” operator causes command injection. e.g : “\u003c (curl  http://xxx.com )” will be executed as a command injection,\n\nMitigation:\n\nall users should upgrade to 2.1.4,  The \"\u003c\" operator will blocked。","exploit_maturity":"No public exploit","published":"2024-07-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-21182","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Exploited in the wild","published":"2024-07-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-49566","description":"\nIn Apache Linkis \u003c=1.5.0, due to the lack of effective filtering\nof parameters, an attacker configuring malicious \n\ndb2\n\n parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. \n\nThis attack requires the attacker to obtain an authorized account from Linkis before it can be carried out.\n\n Versions of Apache Linkis \n\n\u003c=1.5.0\n\n will be affected.\nWe recommend users upgrade the version of Linkis to version 1.6.0.\n","exploit_maturity":"No public exploit","published":"2024-07-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-46801","description":"\nIn Apache Linkis \u003c= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version \u003c 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject malicious files into the server and execute them. \n\nThis attack requires the attacker to obtain an authorized account from Linkis before it can be carried out.  We recommend that users upgrade the java version to \u003e= 1.8.0_241. Or users upgrade Linkis to version 1.6.0.\n\n","exploit_maturity":"No public exploit","published":"2024-07-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-24749","description":"GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass existing input validation in the GeoWebCache ByteStreamController class and read arbitrary classpath resources with specific file name extensions. If GeoServer is also deployed as a web archive using the data directory embedded in the `geoserver.war` file (rather than an external data directory), it will likely be possible to read specific resources to gain administrator privileges. However, it is very unlikely that production environments will be using the embedded data directory since, depending on how GeoServer is deployed, it will be erased and re-installed (which would also reset to the default password) either every time the server restarts or every time a new GeoServer WAR is installed and is therefore difficult to maintain. An external data directory will always be used if GeoServer is running in standalone mode (via an installer or a binary). Versions 2.23.5 and 2.24.3 contain a patch for the issue. Some workarounds are available. One may change from a Windows environment to a Linux environment; or change from Apache Tomcat to Jetty application server. One may also disable anonymous access to the embeded GeoWebCache administration and status pages.","exploit_maturity":"No public exploit","published":"2024-07-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-38374","description":"The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.\n","exploit_maturity":"Proof of concept only","published":"2024-06-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-28982","description":"Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference.","exploit_maturity":"No public exploit","published":"2024-06-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-47621","description":"ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2024-06-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-36117","description":"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.","exploit_maturity":"Working exploit published","published":"2024-06-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-36263","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Submarine Server Core.\n\nThis issue affects Apache Submarine Server Core: all versions.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","exploit_maturity":"No public exploit","published":"2024-06-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-35219","description":"OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available.","exploit_maturity":"Working exploit published","published":"2024-05-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-22354","description":"IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, or to conduct a server-side request forgery attack. IBM X-Force ID: 280401.","exploit_maturity":"No public exploit","published":"2024-04-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-1132","description":"A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.","exploit_maturity":"Proof of concept only","published":"2024-04-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-22262","description":"Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as  CVE-2024-22259 https://spring.io/security/cve-2024-22259  and  CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.","exploit_maturity":"No public exploit","published":"2024-04-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-28109","description":"veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.","exploit_maturity":"No public exploit","published":"2024-03-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-51444","description":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file upload vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with permissions to modify coverage stores through the REST Coverage Store API to upload arbitrary file contents to arbitrary file locations which can lead to remote code execution. Coverage stores that are configured using relative paths use a GeoServer Resource implementation that has validation to prevent path traversal but coverage stores that are configured using absolute paths use a different Resource implementation that does not prevent path traversal. This vulnerability can lead to executing arbitrary code. An administrator with limited privileges could also potentially exploit this to overwrite GeoServer security files and obtain full administrator privileges. Versions 2.23.4 and 2.24.1 contain a fix for this issue.","exploit_maturity":"Proof of concept only","published":"2024-03-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-41877","description":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.23.4 and prior requires GeoServer Administrator with access to the admin console to misconfigure the Global Settings for log file location to an arbitrary location. The admin console GeoServer Logs page provides a preview of these contents. As this issue requires GeoServer administrators access, often representing a trusted party, the vulnerability has not received a patch as of time of publication. As a workaround, a system administrator responsible for running GeoServer can use the `GEOSERVER_LOG_FILE` setting to override any configuration option provided by the Global Settings page. The `GEOSERVER_LOG_LOCATION` parameter can be set as system property, environment variables, or servlet context parameters.","exploit_maturity":"No public exploit","published":"2024-03-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-24042","description":"Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDirect in RuntimeResourcePackImpl component.","exploit_maturity":"No public exploit","published":"2024-03-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-22259","description":"Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as  CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.","exploit_maturity":"No public exploit","published":"2024-03-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-25606","description":"XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.","exploit_maturity":"No public exploit","published":"2024-02-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-22369","description":"Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.\n\nUsers are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1\n\n","exploit_maturity":"No public exploit","published":"2024-02-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-20953","description":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2024-02-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-20931","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Proof of concept only","published":"2024-02-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-23833","description":"OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version\u003c=3.7.7) where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest version of OpenRefine (8.0.30), there is no associated deserialization utilization point, so original code execution cannot be achieved, but attackers can use this vulnerability to read sensitive files on the target server. This issue has been addressed in version 3.7.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.","exploit_maturity":"No public exploit","published":"2024-02-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-23673","description":"Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system.\nIf the system is vulnerable, a user with write access to the repository might be able to trick the Sling Servlet Resolver to load a previously uploaded script. \n\nUsers are recommended to upgrade to version 2.11.0, which fixes this issue. It is recommended to upgrade, regardless of whether your system configuration currently allows this attack or not.","exploit_maturity":"Proof of concept only","published":"2024-02-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-21634","description":"Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.","exploit_maturity":"No public exploit","published":"2024-01-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-51785","description":"Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/9331","exploit_maturity":"No public exploit","published":"2024-01-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-3171","description":"A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.","exploit_maturity":"No public exploit","published":"2023-12-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-6836","description":"Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.","exploit_maturity":"No public exploit","published":"2023-12-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-49898","description":"In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\n\nMitigation:\n\nall users should upgrade to 2.1.2\n\nExample:\n\n##You can customize the splicing method according to the compilation situation of the project, mvn compilation results use \u0026\u0026, compilation failure use \"||\" or \"\u0026\u0026\":\n\n/usr/share/java/maven-3/conf/settings.xml || rm -rf /*\n\n/usr/share/java/maven-3/conf/settings.xml \u0026\u0026 nohup nc x.x.x.x 8899 \u0026\n\n","exploit_maturity":"No public exploit","published":"2023-12-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-28465","description":"The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. NOTE: this issue exists because of an incomplete fix for CVE-2023-24057.","exploit_maturity":"Proof of concept only","published":"2023-12-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-50449","description":"JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.","exploit_maturity":"No public exploit","published":"2023-12-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-46674","description":"An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.\n","exploit_maturity":"No public exploit","published":"2023-12-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-49735","description":"** UNSUPPORTED WHEN ASSIGNED **\n\nThe value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles.\n\nThis issue affects Apache Tiles from version 2 onwards.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\n","exploit_maturity":"No public exploit","published":"2023-11-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-6378","description":"A serialization vulnerability in logback receiver component part of \nlogback version 1.4.11 allows an attacker to mount a Denial-Of-Service \nattack by sending poisoned data.\n\n","exploit_maturity":"No public exploit","published":"2023-11-29","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-48848","description":"An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server by inserting a crafted path.","exploit_maturity":"No public exploit","published":"2023-11-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-41678","description":"Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. \n\nIn details, in ActiveMQ configurations, jetty allows\norg.jolokia.http.AgentServlet to handler request to /api/jolokia\n\norg.jolokia.http.HttpRequestHandler#handlePostRequest is able to\ncreate JmxRequest through JSONObject. And calls to\norg.jolokia.http.HttpRequestHandler#executeRequest.\n\nInto deeper calling stacks,\norg.jolokia.handler.ExecHandler#doHandleRequest can be invoked\nthrough refection. This could lead to RCE through via\nvarious mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.\n\n1 Call newRecording.\n\n2 Call setConfiguration. And a webshell data hides in it.\n\n3 Call startRecording.\n\n4 Call copyTo method. The webshell will be written to a .jsp file.\n\nThe mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia.\nA more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.\n","exploit_maturity":"Working exploit published","published":"2023-11-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-39913","description":"Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK.This issue affects Apache UIMA Java SDK: before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue.\n\nThere are several locations in the code where serialized Java objects are deserialized without verifying the data. This affects in particular:\n  *  the deserialization of a Java-serialized CAS, but also other binary CAS formats that include TSI information using the CasIOUtils class;\n  *  the CAS Editor Eclipse plugin which uses the the CasIOUtils class to load data;\n  *  the deserialization of a Java-serialized CAS of the Vinci Analysis Engine service which can receive using Java-serialized CAS objects over network connections;\n  *  the CasAnnotationViewerApplet and the CasTreeViewerApplet;\n  *  the checkpointing feature of the CPE module.\n\nNote that the UIMA framework by default does not start any remotely accessible services (i.e. Vinci) that would be vulnerable to this issue. A user or developer would need to make an active choice to start such a service. However, users or developers may use the CasIOUtils in their own applications and services to parse serialized CAS data. They are affected by this issue unless they ensure that the data passed to CasIOUtils is not a serialized Java object.\n\nWhen using Vinci or using CasIOUtils in own services/applications, the unrestricted deserialization of Java-serialized CAS files may allow arbitrary (remote) code execution.\n\nAs a remedy, it is possible to set up a global or context-specific ObjectInputFilter (cf.  https://openjdk.org/jeps/290  and  https://openjdk.org/jeps/415 ) if running UIMA on a Java version that supports it. \n\nNote that Java 1.8 does not support the ObjectInputFilter, so there is no remedy when running on this out-of-support platform. An upgrade to a recent Java version is strongly recommended if you need to secure an UIMA version that is affected by this issue.\n\nTo mitigate the issue on a Java 9+ platform, you can configure a filter pattern through the \"jdk.serialFilter\" system property using a semicolon as a separator:\n\nTo allow deserializing Java-serialized binary CASes, add the classes:\n  *  org.apache.uima.cas.impl.CASCompleteSerializer\n  *  org.apache.uima.cas.impl.CASMgrSerializer\n  *  org.apache.uima.cas.impl.CASSerializer\n  *  java.lang.String\n\nTo allow deserializing CPE Checkpoint data, add the following classes (and any custom classes your application uses to store its checkpoints):\n  *  org.apache.uima.collection.impl.cpm.CheckpointData\n  *  org.apache.uima.util.ProcessTrace\n  *  org.apache.uima.util.impl.ProcessTrace_impl\n  *  org.apache.uima.collection.base_cpm.SynchPoint\n\nMake sure to use \"!*\" as the final component to the filter pattern to disallow deserialization of any classes not listed in the pattern.\n\nApache UIMA 3.5.0 uses tightly scoped ObjectInputFilters when reading Java-serialized data depending on the type of data being expected. Configuring a global filter is not necessary with this version.","exploit_maturity":"No public exploit","published":"2023-11-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-46654","description":"Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to delete arbitrary files on the Jenkins controller file system.","exploit_maturity":"No public exploit","published":"2023-10-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-46122","description":"sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.","exploit_maturity":"No public exploit","published":"2023-10-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-46227","description":"\nDeserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.\n\nThis issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can use \\t to bypass. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/8814 \n\n","exploit_maturity":"No public exploit","published":"2023-10-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-45277","description":"Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files.","exploit_maturity":"No public exploit","published":"2023-10-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-43667","description":"Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log records, making it harder to audit\nand trace malicious activities. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/8628","exploit_maturity":"No public exploit","published":"2023-10-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-39410","description":"When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.\n\nThis issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2.  Users should update to apache-avro version 1.11.3 which addresses this issue.","exploit_maturity":"No public exploit","published":"2023-09-29","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-4244","description":"A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.","exploit_maturity":"Proof of concept only","published":"2023-09-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-41886","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.","exploit_maturity":"Proof of concept only","published":"2023-09-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-1415","description":"A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.","exploit_maturity":"No public exploit","published":"2023-09-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-41933","description":"Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2023-09-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-40771","description":"SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function.","exploit_maturity":"Proof of concept only","published":"2023-09-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-40828","description":"An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.","exploit_maturity":"Proof of concept only","published":"2023-08-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-40827","description":"An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.","exploit_maturity":"Proof of concept only","published":"2023-08-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-40826","description":"An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.","exploit_maturity":"Proof of concept only","published":"2023-08-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-24621","description":"An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.","exploit_maturity":"Proof of concept only","published":"2023-08-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-34040","description":"In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n  *  The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record\n  *  The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true.\n  *  The user allows untrusted sources to publish to a Kafka topic\n\n\nBy default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.\n\n\n","exploit_maturity":"Proof of concept only","published":"2023-08-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-40612","description":"In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.","exploit_maturity":"No public exploit","published":"2023-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-39106","description":"An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.","exploit_maturity":"Proof of concept only","published":"2023-08-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-46751","description":"Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2.\n\nWhen Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used.\n\nThis can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways.\n\nStarting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed.\n\nUsers of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about \"JAXP Properties for External Access restrictions\" inside Oracle's \"Java API for XML Processing (JAXP) Security Guide\".","exploit_maturity":"No public exploit","published":"2023-08-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-34434","description":"Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. \n\nThe attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick  https://github.com/apache/inlong/pull/8130 .","exploit_maturity":"No public exploit","published":"2023-07-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-28754","description":"Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML configuration file.\n\nThe attacker needs to have permission to modify the ShardingSphere Agent YAML configuration file on the target machine, and the target machine can access the URL with the arbitrary code JAR.\nAn attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. When the ShardingSphere JVM process starts and uses the ShardingSphere-Agent, the arbitrary code specified by the attacker will be executed during the deserialization of the YAML configuration file by the Agent.\n\nThis issue affects ShardingSphere-Agent: through 5.3.2. This vulnerability is fixed in Apache ShardingSphere 5.4.0.","exploit_maturity":"No public exploit","published":"2023-07-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-37476","description":"OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.","exploit_maturity":"No public exploit","published":"2023-07-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-38286","description":"Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.","exploit_maturity":"Proof of concept only","published":"2023-07-14","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-34603","description":"JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.modules.api.controller.SystemApiController.","exploit_maturity":"Proof of concept only","published":"2023-06-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-34602","description":"JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modules.api.controller.SystemApiController.","exploit_maturity":"Proof of concept only","published":"2023-06-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-3308","description":"A vulnerability classified as problematic has been found in whaleal IceFrog 1.1.8. Affected is an unknown function of the component Aviator Template Engine. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231804.","exploit_maturity":"No public exploit","published":"2023-06-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-3276","description":"A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","exploit_maturity":"Proof of concept only","published":"2023-06-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-3163","description":"A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of the argument value leads to resource consumption. VDB-231090 is the identifier assigned to this vulnerability.","exploit_maturity":"No public exploit","published":"2023-06-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-32315","description":"Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.","exploit_maturity":"Exploited in the wild","published":"2023-05-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-33945","description":"SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded.","exploit_maturity":"No public exploit","published":"2023-05-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-4815","description":"\nHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods. \n\n","exploit_maturity":"No public exploit","published":"2023-05-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-31058","description":"Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the\n'autoDeserialize' option filtering by adding blanks.  Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick \n\n https://github.com/apache/inlong/pull/7674 https://github.com/apache/inlong/pull/7674  to solve it.\n\n","exploit_maturity":"No public exploit","published":"2023-05-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-32007","description":"** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This issue was disclosed earlier as CVE-2022-33891, but incorrectly claimed version 3.1.3 (which has since gone EOL) would not be affected.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\nUsers are recommended to upgrade to a supported version of Apache Spark, such as version 3.4.0.","exploit_maturity":"Forecast only","published":"2023-05-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-21931","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Forecast only","published":"2023-04-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-21930","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and  22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"No public exploit","published":"2023-04-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-30535","description":"Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. The vulnerability was patched on March 17, 2023 as part of Snowflake JDBC driver Version 3.13.29. All users should immediately upgrade the Snowflake JDBC driver to the latest version: 3.13.29.","exploit_maturity":"No public exploit","published":"2023-04-14","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-43941","description":"\nHitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference. \n\n","exploit_maturity":"No public exploit","published":"2023-04-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-28683","description":"Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2023-04-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-28682","description":"Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2023-04-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-28681","description":"Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2023-04-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-28680","description":"Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2023-04-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-28935","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache UIMA DUCC.\n\n\nWhen using the \"Distributed UIMA Cluster Computing\" (DUCC) module of Apache UIMA, an authenticated user that has the permissions to modify core entities can cause command execution as the system user that runs the web process.\n\n\nAs the \"Distributed UIMA Cluster Computing\" module for UIMA is retired, we do not plan to release a fix for this issue.\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\n","exploit_maturity":"No public exploit","published":"2023-03-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-27296","description":"Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.\n\nIt could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability.\n\nThis issue affects Apache InLong: from 1.1.0 through 1.5.0.  Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it.\n\n\n\n[1]  https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html\n\n https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html \n\n[2]  https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422 \n\n\n\n","exploit_maturity":"No public exploit","published":"2023-03-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-28685","description":"Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2023-03-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-28118","description":"kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds.","exploit_maturity":"No public exploit","published":"2023-03-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-46877","description":"jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.","exploit_maturity":"No public exploit","published":"2023-03-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-26464","description":"** UNSUPPORTED WHEN ASSIGNED **\n\nWhen using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) \nhashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized.\n\nThis issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","exploit_maturity":"No public exploit","published":"2023-03-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-27480","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host. This vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1. Users are advised to upgrade. Users unable to upgrade may apply the patch `e3527b98fd` manually.","exploit_maturity":"No public exploit","published":"2023-03-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-24789","description":"jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component.","exploit_maturity":"Proof of concept only","published":"2023-03-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-15026","description":"A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The patch is identified as 8c954e8d9f6f6863729e50105a8abf3f87fff74c. It is recommended to upgrade the affected component. VDB-221486 is the identifier assigned to this vulnerability.","exploit_maturity":"No public exploit","published":"2023-02-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-23926","description":"APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way and therefore allowed this. External entities can be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application. Abusing the XXE vulnerability enabled assessors to read local files remotely. Although with the level of privileges assessors had this was limited to one-line files. With the ability to write to the database, any file could have been read. Additionally, assessors noted, with local testing, the server could be crashed by passing in improperly formatted XML. The minimum version containing a patch for this vulnerability is 5.5.0. Those who cannot upgrade the library can control the allowlist of the procedures that can be used in your system.","exploit_maturity":"No public exploit","published":"2023-02-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-24187","description":"An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.","exploit_maturity":"Proof of concept only","published":"2023-02-14","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-22832","description":"The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references.\n\nFlow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references.\n\nThe resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.\n\n","exploit_maturity":"No public exploit","published":"2023-02-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-25194","description":"A possible security vulnerability has been identified in Apache Kafka Connect API.\nThis requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config\nand a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0.\nWhen configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config`\nproperty for any of the connector's Kafka clients to \"com.sun.security.auth.module.JndiLoginModule\", which can be done via the\n`producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties.\nThis will allow the server to connect to the attacker's LDAP server\nand deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.\nAttacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.\n\nSince Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box\nconfigurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector\nclient override policy that permits them.\n\nSince Apache Kafka 3.4.0, we have added a system property (\"-Dorg.apache.kafka.disallowed.login.modules\") to disable the problematic login modules usage\nin SASL JAAS configuration. Also by default \"com.sun.security.auth.module.JndiLoginModule\" is disabled in Apache Kafka Connect 3.4.0. \n\nWe advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for \nvulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally,\nin addition to leveraging the \"org.apache.kafka.disallowed.login.modules\" system property, Kafka Connect users can also implement their own connector\nclient config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.\n","exploit_maturity":"Working exploit published","published":"2023-02-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-44645","description":"In Apache Linkis \u003c=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis \u003c= 1.3.0 will be affected.\n\nWe recommend users to upgrade the version of Linkis to version 1.3.1.\n","exploit_maturity":"No public exploit","published":"2023-01-31","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-2712","description":"In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code. This is fixed in GlassFish 7.0.0.","exploit_maturity":"No public exploit","published":"2023-01-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-24422","description":"A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.","exploit_maturity":"No public exploit","published":"2023-01-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-24057","description":"HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).","exploit_maturity":"Proof of concept only","published":"2023-01-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-21839","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Exploited in the wild","published":"2023-01-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-21837","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"No public exploit","published":"2023-01-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-23532","description":"APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vulnerability found in the apoc.export.* procedures of apoc plugins in Neo4j Graph database. The issue allows a malicious actor to potentially break out of the expected directory. The vulnerability is such that files could only be created but not overwritten. For the vulnerability to be exploited, an attacker would need access to execute an arbitrary query, either by having access to an authenticated Neo4j client, or a Cypher injection vulnerability in an application. The minimum versions containing patch for this vulnerability are 4.4.0.12 and 4.3.0.12 and 5.3.1. As a workaround, you can control the allowlist of the procedures that can be used in your system, and/or turn off local file access by setting apoc.export.file.enabled=false.","exploit_maturity":"No public exploit","published":"2023-01-14","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-38723","description":"Gravitee API Management before 3.15.13 allows path traversal through HTML injection.","exploit_maturity":"No public exploit","published":"2023-01-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-43396","description":"In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.","exploit_maturity":"Forecast only","published":"2022-12-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-46178","description":"MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability has been fixed in v2.5.1. There are no workarounds.","exploit_maturity":"Proof of concept only","published":"2022-12-29","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-41966","description":"XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.","exploit_maturity":"Proof of concept only","published":"2022-12-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-4772","description":"A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.","exploit_maturity":"No public exploit","published":"2022-12-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-10650","description":"A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.","exploit_maturity":"Proof of concept only","published":"2022-12-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-34271","description":"A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem.  This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.","exploit_maturity":"No public exploit","published":"2022-12-14","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-45921","description":"FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.","exploit_maturity":"No public exploit","published":"2022-11-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-45470","description":"missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issues to be fixed.","exploit_maturity":"No public exploit","published":"2022-11-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-4065","description":"A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027.","exploit_maturity":"No public exploit","published":"2022-11-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-45381","description":"Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.","exploit_maturity":"No public exploit","published":"2022-11-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-42125","description":"Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.","exploit_maturity":"No public exploit","published":"2022-11-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-42123","description":"A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create or overwrite existing files on the filesystem via the installation of a malicious Elasticsearch Sidecar plugin.","exploit_maturity":"No public exploit","published":"2022-11-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-42121","description":"A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.","exploit_maturity":"No public exploit","published":"2022-11-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-37866","description":"When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied \"pattern\" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain \"../\" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing \"..\" sequences and a \"normal\" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.","exploit_maturity":"No public exploit","published":"2022-11-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-32287","description":"A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. This issue affects Apache UIMA Apache UIMA version 3.3.0 and prior versions. Note that PEAR files should never be installed into an UIMA installation from untrusted sources because PEAR archives are executable plugins that will be able to perform any actions with the same privileges as the host Java Virtual Machine.","exploit_maturity":"No public exploit","published":"2022-11-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-39944","description":"In Apache Linkis \u003c=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis \u003c= 1.2.0 will be affected, We recommend users to update to 1.3.0.","exploit_maturity":"No public exploit","published":"2022-10-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-43430","description":"Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-10-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-43415","description":"Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-10-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-42004","description":"In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.","exploit_maturity":"No public exploit","published":"2022-10-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-40705","description":"An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer","exploit_maturity":"No public exploit","published":"2022-09-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-28981","description":"Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.","exploit_maturity":"No public exploit","published":"2022-09-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-40955","description":"In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.","exploit_maturity":"No public exploit","published":"2022-09-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-40151","description":"Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.","exploit_maturity":"Proof of concept only","published":"2022-09-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-40635","description":"Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.","exploit_maturity":"No public exploit","published":"2022-09-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-40634","description":"Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.","exploit_maturity":"No public exploit","published":"2022-09-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-26049","description":"This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve remote code execution on a target system by exploiting this vulnerability. **Note:** This could have allowed a malicious zip file to extract itself into an arbitrary directory. The only file that Goomph extracts is the p2 bootstrapper and eclipse metadata files hosted at eclipse.org, which are not malicious, so the only way this vulnerability could have affected you is if you had set a custom bootstrap zip, and that zip was malicious.","exploit_maturity":"No public exploit","published":"2022-09-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-28220","description":"Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.","exploit_maturity":"No public exploit","published":"2022-09-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-37022","description":"Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks. This should have no impact on performance since it only affects JMX/RMI which Gfsh uses to communicate with the JMX Manager which is hosted on a Locator.","exploit_maturity":"No public exploit","published":"2022-08-31","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-25857","description":"The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.","exploit_maturity":"No public exploit","published":"2022-08-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-25642","description":"ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.4 or later (containing YARN-11126) if ZKConfigurationStore is used.","exploit_maturity":"No public exploit","published":"2022-08-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-37422","description":"Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded.","exploit_maturity":"No public exploit","published":"2022-08-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-37423","description":"Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream.","exploit_maturity":"No public exploit","published":"2022-08-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-31197","description":"PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue.","exploit_maturity":"Proof of concept only","published":"2022-08-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-31195","description":"DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF (simple archive format) package could cause a file/directory to be created anywhere the Tomcat/DSpace user can write to on the server. However, this path traversal vulnerability is only possible by a user with special privileges (either Administrators or someone with command-line access to the server). This vulnerability impacts the XMLUI, JSPUI and command-line. Users are advised to upgrade. As a basic workaround, users may block all access to the following URL paths: If you are using the XMLUI, block all access to /admin/batchimport path (this is the URL of the Admin Batch Import tool). Keep in mind, if your site uses the path \"/xmlui\", then you'd need to block access to /xmlui/admin/batchimport. If you are using the JSPUI, block all access to /dspace-admin/batchimport path (this is the URL of the Admin Batch Import tool). Keep in mind, if your site uses the path \"/jspui\", then you'd need to block access to /jspui/dspace-admin/batchimport. Keep in mind, only an Administrative user or a user with command-line access to the server is able to import/upload SAF packages. Therefore, assuming those users do not blindly upload untrusted SAF packages, then it is unlikely your site could be impacted by this vulnerability.","exploit_maturity":"No public exploit","published":"2022-08-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-31194","description":"DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowing an attacker to create files/directories anywhere on the server writable by the Tomcat/DSpace user, by modifying some request parameters during submission. This path traversal can only be executed by a user with special privileges (submitter rights). This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds. However, this vulnerability cannot be exploited by an anonymous user or a basic user. The user must first have submitter privileges to at least one Collection and be able to determine how to modify the request parameters to exploit the vulnerability.","exploit_maturity":"No public exploit","published":"2022-08-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-36889","description":"Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.","exploit_maturity":"No public exploit","published":"2022-07-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-34114","description":"Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.","exploit_maturity":"No public exploit","published":"2022-07-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-34169","description":"The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.","exploit_maturity":"Proof of concept only","published":"2022-07-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-33891","description":"The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.","exploit_maturity":"Exploited in the wild","published":"2022-07-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-31159","description":"The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory. This issue’s scope is limited to directories whose name prefix matches the destinationDirectory. E.g. for destination directory`/tmp/foo`, the actor can cause a download to `/tmp/foo-bar`, but not `/tmp/bar`. If `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory` is used to download an untrusted buckets contents, the contents of that bucket can be written outside of the intended destination directory. Version 1.12.261 contains a patch for this issue. As a workaround, when calling `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory`, pass a `KeyFilter` that forbids `S3ObjectSummary` objects that `getKey` method return a string containing the substring `..` .","exploit_maturity":"Proof of concept only","published":"2022-07-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-34793","description":"Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-06-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-26477","description":"The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a \"low-priority but useful improvement\". SystemDS is a distributed system and needs to serialize/deserialize data but in many code paths (e.g., on Spark broadcast/shuffle or writing to sequence files) the byte stream is anyway protected by additional CRC fingerprints. In this particular case though, the number of decoders is upper-bounded by twice the number of columns, which means an attacker would need to modify two entries in the byte stream in a consistent manner. By adding these checks robustness was strictly improved with almost zero overhead. These code changes are available in versions higher than 2.2.1.","exploit_maturity":"No public exploit","published":"2022-06-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-34179","description":"Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to specify paths to other SVG images on the Jenkins controller file system.","exploit_maturity":"No public exploit","published":"2022-06-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-34177","description":"Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.","exploit_maturity":"No public exploit","published":"2022-06-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-33140","description":"The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. Command injection requires ShellUserGroupProvider to be one of the enabled User Group Providers in the Authorizers configuration. Command injection also requires an authenticated user with elevated privileges. Apache NiFi requires an authenticated user with authorization to modify access policies in order to execute the command. Apache NiFi Registry requires an authenticated user with authorization to read user groups in order to execute the command. The resolution removes command formatting based on user-provided arguments.","exploit_maturity":"No public exploit","published":"2022-06-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-33036","description":"In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.","exploit_maturity":"No public exploit","published":"2022-06-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-23082","description":"In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.","exploit_maturity":"No public exploit","published":"2022-05-31","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-31268","description":"A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).","exploit_maturity":"Working exploit published","published":"2022-05-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-21500","description":"Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite accessible data. Note: Authentication is required for successful attack, however the user may be self-registered. \u003cbr\u003e \u003cbr\u003eOracle E-Business Suite 12.1 is not impacted by this vulnerability. Customers should refer to the Patch Availability Document for details. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2022-05-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-30971","description":"Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-05-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-30948","description":"Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.","exploit_maturity":"No public exploit","published":"2022-05-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-30947","description":"Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.","exploit_maturity":"No public exploit","published":"2022-05-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-24897","description":"APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. The problem has been patched in versions 12.6.7, 12.10.3, and 13.0. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.","exploit_maturity":"Proof of concept only","published":"2022-05-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-25647","description":"The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.","exploit_maturity":"No public exploit","published":"2022-05-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-29265","description":"Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML External Entity references when configured with default property values: - EvaluateXPath - EvaluateXQuery - ValidateXml Apache NiFi flow configurations that include these Processors are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations in the default configuration for these Processors, and disallows XML External Entity resolution in standard services.","exploit_maturity":"No public exploit","published":"2022-04-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-21476","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"No public exploit","published":"2022-04-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-21449","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","exploit_maturity":"Proof of concept only","published":"2022-04-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-24847","description":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism. In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API. The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 1.19.6. Users unable to upgrade should restrict access to the `geoserver/web` and `geoserver/rest` via a firewall and ensure that the GeoWebCache is not remotely accessible.","exploit_maturity":"No public exploit","published":"2022-04-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-24827","description":"Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the '-' character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments ('--') and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.","exploit_maturity":"No public exploit","published":"2022-04-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-44138","description":"There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.","exploit_maturity":"Working exploit published","published":"2022-04-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-28155","description":"Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-03-29","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-28154","description":"Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-03-29","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-28140","description":"Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-03-29","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-23214","description":"When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.","exploit_maturity":"No public exploit","published":"2022-03-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-46062","description":"MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.","exploit_maturity":"No public exploit","published":"2022-02-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-46037","description":"MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.","exploit_maturity":"No public exploit","published":"2022-02-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-25209","description":"Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2022-02-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-25175","description":"Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.","exploit_maturity":"No public exploit","published":"2022-02-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-25174","description":"Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.","exploit_maturity":"No public exploit","published":"2022-02-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-25173","description":"Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.","exploit_maturity":"No public exploit","published":"2022-02-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-24289","description":"Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and earlier, running on non-current patch versions of Java, an attacker with client access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This can result in arbitrary code execution.","exploit_maturity":"No public exploit","published":"2022-02-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-46365","description":"An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.","exploit_maturity":"No public exploit","published":"2022-02-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-46364","description":"A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.","exploit_maturity":"No public exploit","published":"2022-02-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-0538","description":"Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.","exploit_maturity":"No public exploit","published":"2022-02-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-23913","description":"In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.","exploit_maturity":"No public exploit","published":"2022-02-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-43859","description":"XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.","exploit_maturity":"Proof of concept only","published":"2022-02-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-23181","description":"The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.","exploit_maturity":"No public exploit","published":"2022-01-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-46385","description":"https://gitee.com/mingSoft/MCMS MCMS \u003c=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.FormDataAction#queryData. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.","exploit_maturity":"No public exploit","published":"2022-01-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-46383","description":"https://gitee.com/mingSoft/MCMS MCMS \u003c=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.","exploit_maturity":"No public exploit","published":"2022-01-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-41766","description":"Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder).","exploit_maturity":"No public exploit","published":"2022-01-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-21371","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2022-01-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-23307","description":"CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.","exploit_maturity":"Forecast only","published":"2022-01-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-23302","description":"JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.","exploit_maturity":"Forecast only","published":"2022-01-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-0198","description":"corenlp is vulnerable to Improper Restriction of XML External Entity Reference","exploit_maturity":"No public exploit","published":"2022-01-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-23107","description":"Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system.","exploit_maturity":"No public exploit","published":"2022-01-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-20617","description":"Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.","exploit_maturity":"No public exploit","published":"2022-01-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-20318","description":"The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.","exploit_maturity":"No public exploit","published":"2021-12-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-4104","description":"JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.","exploit_maturity":"Proof of concept only","published":"2021-12-14","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-3376","description":"An issue was discovered in Cuppa CMS Versions Before 31 Jan 2021 allows authenticated attackers to gain escalated privileges via a crafted POST request using the user_group_id_field parameter.","exploit_maturity":"No public exploit","published":"2021-12-14","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-43795","description":"Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.","exploit_maturity":"No public exploit","published":"2021-12-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-43577","description":"Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2021-11-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21698","description":"Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21686","description":"File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-27644","description":"In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)","exploit_maturity":"No public exploit","published":"2021-11-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-3869","description":"corenlp is vulnerable to Improper Restriction of XML External Entity Reference","exploit_maturity":"No public exploit","published":"2021-10-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-37136","description":"The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack","exploit_maturity":"No public exploit","published":"2021-10-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-42340","description":"The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","exploit_maturity":"No public exploit","published":"2021-10-14","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39239","description":"A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.","exploit_maturity":"No public exploit","published":"2021-09-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-36162","description":"Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will be able to poison the rule so when retrieved by the consumers, it will get RCE on all of them. This was fixed in Dubbo 2.7.13, 3.0.2","exploit_maturity":"No public exploit","published":"2021-09-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-37713","description":"The npm package \"tar\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\\path`. If the drive letter does not match the extraction target, for example `D:\\extraction\\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..` portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not properly sanitized by the logic that checked for `..` within the normalized and split portions of the path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.","exploit_maturity":"No public exploit","published":"2021-08-31","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-37712","description":"The npm package \"tar\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 \"short path\" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.","exploit_maturity":"No public exploit","published":"2021-08-31","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-37701","description":"The npm package \"tar\" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both `\\` and `/` characters as path separators, however `\\` is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at `FOO`, followed by a symbolic link named `foo`, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but _not_ from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the `FOO` directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.","exploit_maturity":"No public exploit","published":"2021-08-31","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21680","description":"Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2021-08-31","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21677","description":"Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerability.","exploit_maturity":"No public exploit","published":"2021-08-31","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39132","description":"Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14","exploit_maturity":"No public exploit","published":"2021-08-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39154","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"No public exploit","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39153","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"No public exploit","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39152","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.","exploit_maturity":"Working exploit published","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39151","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"No public exploit","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39150","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.","exploit_maturity":"No public exploit","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39149","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"No public exploit","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39148","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"No public exploit","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39147","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"No public exploit","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39146","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"Working exploit published","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39145","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"No public exploit","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39144","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"Exploited in the wild","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39141","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"Working exploit published","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39139","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"No public exploit","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-32804","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.","exploit_maturity":"No public exploit","published":"2021-08-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-32803","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.","exploit_maturity":"No public exploit","published":"2021-08-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-31799","description":"In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.","exploit_maturity":"No public exploit","published":"2021-07-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-2351","description":"Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: \"Changes in Native Network Encryption with the July 2021 Critical Patch Update\" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-07-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-32769","description":"Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using \"/../../\" in the URL. This occurs because Micronaut does not restrict file access to configured paths. The vulnerability is patched in version 2.5.9. As a workaround, do not use `**` in mapping, use only `*`, which exposes only flat structure of a directory not allowing traversal. If using Linux, another workaround is to run micronaut in chroot.","exploit_maturity":"No public exploit","published":"2021-07-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-29620","description":"Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.","exploit_maturity":"No public exploit","published":"2021-06-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-33813","description":"An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.","exploit_maturity":"No public exploit","published":"2021-06-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-32623","description":"Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using a single HTTP request. To exploit this, users need to have ingest privileges, limiting the group of potential attackers The problem has been fixed in Opencast 9.6. There is no known workaround for this issue.","exploit_maturity":"No public exploit","published":"2021-06-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-29505","description":"XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.","exploit_maturity":"Working exploit published","published":"2021-05-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-22118","description":"In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.","exploit_maturity":"No public exploit","published":"2021-05-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-20492","description":"IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793.","exploit_maturity":"No public exploit","published":"2021-05-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21659","description":"Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"Forecast only","published":"2021-05-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21657","description":"Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2021-05-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-29053","description":"Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.","exploit_maturity":"No public exploit","published":"2021-05-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21656","description":"Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2021-05-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-36321","description":"Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.","exploit_maturity":"No public exploit","published":"2021-04-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21642","description":"Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2021-04-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-20454","description":"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196649.","exploit_maturity":"No public exploit","published":"2021-04-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-20453","description":"IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196648.","exploit_maturity":"No public exploit","published":"2021-04-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21380","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those with the Ratings API installed), the Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. This might lead to an SQL script injection quite easily for any user having Script rights on XWiki. The problem has been patched in XWiki 12.9RC1. The only workaround besides upgrading XWiki would be to uninstall the Ratings API in XWiki from the Extension Manager.","exploit_maturity":"Proof of concept only","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21349","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"No public exploit","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21348","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"No public exploit","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21343","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"No public exploit","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21341","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"Forecast only","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-20218","description":"A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2","exploit_maturity":"No public exploit","published":"2021-03-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-25329","description":"The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.","exploit_maturity":"No public exploit","published":"2021-03-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-25122","description":"When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.","exploit_maturity":"No public exploit","published":"2021-03-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-20354","description":"IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially-crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 194883.","exploit_maturity":"No public exploit","published":"2021-02-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-23337","description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","exploit_maturity":"Working exploit published","published":"2021-02-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-20353","description":"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 194882.","exploit_maturity":"No public exploit","published":"2021-02-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-4949","description":"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192025.","exploit_maturity":"No public exploit","published":"2021-01-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-17532","description":"When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5","exploit_maturity":"No public exploit","published":"2021-01-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-2109","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2021-01-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-20190","description":"A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","exploit_maturity":"No public exploit","published":"2021-01-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21605","description":"Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file.","exploit_maturity":"No public exploit","published":"2021-01-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21604","description":"Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator.","exploit_maturity":"No public exploit","published":"2021-01-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-36188","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.","exploit_maturity":"Proof of concept only","published":"2021-01-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21234","description":"spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package \"eu.hinsch:spring-boot-actuator-logview\". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile\u0026base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy.","exploit_maturity":"Working exploit published","published":"2021-01-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-17518","description":"Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.","exploit_maturity":"Working exploit published","published":"2021-01-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-26258","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.","exploit_maturity":"Working exploit published","published":"2020-12-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-25649","description":"A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.","exploit_maturity":"No public exploit","published":"2020-12-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2324","description":"Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2020-12-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-25638","description":"A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.","exploit_maturity":"No public exploit","published":"2020-12-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-15685","description":"Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.","exploit_maturity":"No public exploit","published":"2020-11-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-15684","description":"Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.","exploit_maturity":"No public exploit","published":"2020-11-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-15683","description":"In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.","exploit_maturity":"No public exploit","published":"2020-11-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-26217","description":"XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.","exploit_maturity":"Working exploit published","published":"2020-11-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-17566","description":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","exploit_maturity":"No public exploit","published":"2020-11-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-14366","description":"A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw","exploit_maturity":"No public exploit","published":"2020-11-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-10721","description":"A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","exploit_maturity":"No public exploit","published":"2020-10-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-14883","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2020-10-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-14864","description":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Exploited in the wild","published":"2020-10-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-26945","description":"MyBatis before 3.5.6 mishandles deserialization of object streams.","exploit_maturity":"No public exploit","published":"2020-10-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2284","description":"Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2020-09-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-4643","description":"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information. IBM X-Force ID: 185590.","exploit_maturity":"No public exploit","published":"2020-09-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-24750","description":"FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.","exploit_maturity":"No public exploit","published":"2020-09-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2276","description":"Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running as.","exploit_maturity":"No public exploit","published":"2020-09-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2261","description":"Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller","exploit_maturity":"No public exploit","published":"2020-09-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-11977","description":"In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution.","exploit_maturity":"No public exploit","published":"2020-09-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-24164","description":"A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.","exploit_maturity":"No public exploit","published":"2020-09-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2245","description":"Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2020-09-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-7712","description":"This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.","exploit_maturity":"No public exploit","published":"2020-08-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-15777","description":"An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization gadget chain. The socket is not bound exclusively to localhost. The port this socket is assigned to is randomly selected and is not intentionally exposed to the public (either by design or documentation). This could potentially be used to achieve remote code execution and local privilege escalation.","exploit_maturity":"No public exploit","published":"2020-08-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-15842","description":"Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.","exploit_maturity":"No public exploit","published":"2020-07-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-4464","description":"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of serialized objects over the SOAP connector. IBM X-Force ID: 181489.","exploit_maturity":"Proof of concept only","published":"2020-07-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2211","description":"Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.","exploit_maturity":"No public exploit","published":"2020-07-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-10740","description":"A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.","exploit_maturity":"No public exploit","published":"2020-06-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-14195","description":"FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).","exploit_maturity":"No public exploit","published":"2020-06-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-5411","description":"When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known \"deserialization gadgets\". Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true: * Spring Batch's Jackson support is being leveraged to serialize a job's ExecutionContext. * A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored). In order to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being deserialized. Spring Batch should be proactive against blocking unknown \"deserialization gadgets\" when enabling default typing.","exploit_maturity":"No public exploit","published":"2020-06-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-4449","description":"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181230.","exploit_maturity":"No public exploit","published":"2020-06-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2200","description":"Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master.","exploit_maturity":"No public exploit","published":"2020-06-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-5410","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.","exploit_maturity":"Exploited in the wild","published":"2020-06-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-1956","description":"Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.","exploit_maturity":"Exploited in the wild","published":"2020-05-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-9484","description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","exploit_maturity":"Working exploit published","published":"2020-05-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-1714","description":"A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.","exploit_maturity":"No public exploit","published":"2020-05-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-12760","description":"An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions.","exploit_maturity":"No public exploit","published":"2020-05-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2189","description":"Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.","exploit_maturity":"No public exploit","published":"2020-05-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-12642","description":"An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.","exploit_maturity":"No public exploit","published":"2020-05-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2180","description":"Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.","exploit_maturity":"No public exploit","published":"2020-04-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2179","description":"Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.","exploit_maturity":"No public exploit","published":"2020-04-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2178","description":"Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2020-04-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2816","description":"Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","exploit_maturity":"No public exploit","published":"2020-04-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-5280","description":"http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.","exploit_maturity":"No public exploit","published":"2020-03-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2171","description":"Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2020-03-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2168","description":"Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.","exploit_maturity":"No public exploit","published":"2020-03-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2167","description":"Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.","exploit_maturity":"No public exploit","published":"2020-03-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2166","description":"Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.","exploit_maturity":"No public exploit","published":"2020-03-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2159","description":"Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins.","exploit_maturity":"No public exploit","published":"2020-03-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2158","description":"Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.","exploit_maturity":"No public exploit","published":"2020-03-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2144","description":"Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2020-03-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2138","description":"Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2020-03-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-1937","description":"Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.","exploit_maturity":"No public exploit","published":"2020-02-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2123","description":"Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.","exploit_maturity":"No public exploit","published":"2020-02-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2121","description":"Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.","exploit_maturity":"No public exploit","published":"2020-02-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2120","description":"Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2020-02-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2115","description":"Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2020-02-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2108","description":"Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions.","exploit_maturity":"No public exploit","published":"2020-01-29","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2658","description":"Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Others). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iSupport accessible data as well as unauthorized update, insert or delete access to some of Oracle iSupport accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","exploit_maturity":"No public exploit","published":"2020-01-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2604","description":"Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2020-01-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-2092","description":"Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.","exploit_maturity":"No public exploit","published":"2020-01-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2015-1811","description":"XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.","exploit_maturity":"No public exploit","published":"2020-01-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2015-1809","description":"XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.","exploit_maturity":"No public exploit","published":"2020-01-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-17563","description":"When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.","exploit_maturity":"No public exploit","published":"2019-12-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-16549","description":"Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents.","exploit_maturity":"No public exploit","published":"2019-12-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-3643","description":"jersey: XXE via parameter entities not disabled by the jersey SAX parser","exploit_maturity":"No public exploit","published":"2019-12-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-16777","description":"Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","exploit_maturity":"No public exploit","published":"2019-12-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-16776","description":"Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","exploit_maturity":"No public exploit","published":"2019-12-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-18640","description":"The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.","exploit_maturity":"No public exploit","published":"2019-12-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-10174","description":"A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.","exploit_maturity":"No public exploit","published":"2019-11-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-10172","description":"A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.","exploit_maturity":"No public exploit","published":"2019-11-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-10466","description":"An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.","exploit_maturity":"No public exploit","published":"2019-10-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-2890","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2019-10-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-3834","description":"It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.","exploit_maturity":"No public exploit","published":"2019-10-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-0207","description":"Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -\u003e AssetDispatcher -\u003e ContextResource`, which doesn't filter the character `\\`, so attacker can perform a path traversal attack to read any files on Windows platform.","exploit_maturity":"No public exploit","published":"2019-09-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-10392","description":"Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.","exploit_maturity":"Proof of concept only","published":"2019-09-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-12401","description":"Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.","exploit_maturity":"No public exploit","published":"2019-09-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-5475","description":"The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.","exploit_maturity":"Proof of concept only","published":"2019-09-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-15630","description":"Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow remote attackers to read files accessible to the Mule process.","exploit_maturity":"No public exploit","published":"2019-08-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-10086","description":"In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.","exploit_maturity":"No public exploit","published":"2019-08-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-14439","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.","exploit_maturity":"Proof of concept only","published":"2019-07-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-9843","description":"In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.","exploit_maturity":"No public exploit","published":"2019-06-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-5442","description":"XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.","exploit_maturity":"No public exploit","published":"2019-06-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-10337","description":"An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.","exploit_maturity":"No public exploit","published":"2019-06-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-10327","description":"An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks.","exploit_maturity":"No public exploit","published":"2019-05-31","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-0188","description":"Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.","exploit_maturity":"No public exploit","published":"2019-05-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-10750","description":"In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.","exploit_maturity":"No public exploit","published":"2019-05-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-12086","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.","exploit_maturity":"No public exploit","published":"2019-05-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-11082","description":"core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the overwrite of local files with the contents of an archive.","exploit_maturity":"No public exploit","published":"2019-05-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-0194","description":"Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.","exploit_maturity":"No public exploit","published":"2019-04-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-2616","description":"Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).","exploit_maturity":"Exploited in the wild","published":"2019-04-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-2602","description":"Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","exploit_maturity":"No public exploit","published":"2019-04-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-5427","description":"c3p0 version \u003c 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.","exploit_maturity":"No public exploit","published":"2019-04-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-0232","description":"When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).","exploit_maturity":"Working exploit published","published":"2019-04-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-0225","description":"A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.","exploit_maturity":"No public exploit","published":"2019-03-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-5418","description":"There is a File Content Disclosure vulnerability in Action View \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.","exploit_maturity":"Exploited in the wild","published":"2019-03-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-12023","description":"An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.","exploit_maturity":"No public exploit","published":"2019-03-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-12022","description":"An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.","exploit_maturity":"No public exploit","published":"2019-03-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-7722","description":"PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)","exploit_maturity":"No public exploit","published":"2019-02-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-7548","description":"SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.","exploit_maturity":"No public exploit","published":"2019-02-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-6986","description":"SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of service (ReDoS), as demonstrated by crafted use of FILTER%20regex in a /individual?uri= request.","exploit_maturity":"No public exploit","published":"2019-01-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000850","description":"Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources otherwise unavailable to her.. This attack appear to be exploitable via An attacker should have access to an encoded path parameter on POST, PUT or DELETE request.. This vulnerability appears to have been fixed in 2.5.0 and later.","exploit_maturity":"No public exploit","published":"2018-12-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000817","description":"Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially crafted GET request containing directory traversal from assets-pipeline context. This vulnerability appears to have been fixed in 2.14.1.1 (for Grails 2.x), 2.15.1 (for Grails 3 and Java 7) and 3.0.6 (for Grails 3 and Java 8).","exploit_maturity":"No public exploit","published":"2018-12-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-20227","description":"RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.","exploit_maturity":"No public exploit","published":"2018-12-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-20094","description":"An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java.","exploit_maturity":"No public exploit","published":"2018-12-12","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-20000","description":"Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.","exploit_maturity":"No public exploit","published":"2018-12-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000863","description":"A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.","exploit_maturity":"No public exploit","published":"2018-12-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-19907","description":"A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a web page.","exploit_maturity":"No public exploit","published":"2018-12-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1905","description":"IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152534.","exploit_maturity":"No public exploit","published":"2018-11-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-8009","description":"Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.","exploit_maturity":"No public exploit","published":"2018-11-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-17186","description":"An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.","exploit_maturity":"No public exploit","published":"2018-11-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-18831","description":"An issue was discovered in com\\mingsoft\\cms\\action\\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file (in the position parameter) to an arbitrary directory via a ../ Directory Traversal in the url parameter.","exploit_maturity":"No public exploit","published":"2018-10-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-3149","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2018-10-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-11796","description":"In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.","exploit_maturity":"No public exploit","published":"2018-10-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-17785","description":"In blynk-server in Blynk before 0.39.7, Directory Traversal exists via a ../ in a URI that has /static or /static/js at the beginning, as demonstrated by reading the /etc/passwd file.","exploit_maturity":"No public exploit","published":"2018-09-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-17605","description":"An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in AssetPipelineFilter.groovy or AssetPipelineFilterCore.groovy.","exploit_maturity":"No public exploit","published":"2018-09-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-17297","description":"The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.","exploit_maturity":"No public exploit","published":"2018-09-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-11761","description":"In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.","exploit_maturity":"Proof of concept only","published":"2018-09-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-0750","description":"The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.","exploit_maturity":"No public exploit","published":"2018-09-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-11776","description":"Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.","exploit_maturity":"Exploited in the wild","published":"2018-08-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-11758","description":"This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with Apache Cayenne and intended for editing Cayenne ORM models stored as XML files. If an attacker tricks a user of CayenneModeler into opening a malicious XML file, the attacker will be able to instruct the XML parser built into CayenneModeler to transfer files from a local machine to a remote machine controlled by the attacker. The cause of the issue is XML parser processing XML External Entity (XXE) declarations included in XML. The vulnerability is addressed in Cayenne by disabling XXE processing in all operations that require XML parsing.","exploit_maturity":"No public exploit","published":"2018-08-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1656","description":"The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.","exploit_maturity":"No public exploit","published":"2018-08-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-12539","description":"In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows, Linux and AIX JVMs and can be disabled using the command line option -Dcom.ibm.tools.attach.enable=no.","exploit_maturity":"No public exploit","published":"2018-08-14","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-8648","description":"It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.","exploit_maturity":"No public exploit","published":"2018-08-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-2595","description":"It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal.","exploit_maturity":"No public exploit","published":"2018-07-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-14371","description":"The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.","exploit_maturity":"No public exploit","published":"2018-07-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-13864","description":"A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.","exploit_maturity":"No public exploit","published":"2018-07-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-10726","description":"The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.","exploit_maturity":"No public exploit","published":"2018-07-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-13439","description":"WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL.","exploit_maturity":"No public exploit","published":"2018-07-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-3203","description":"The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.","exploit_maturity":"No public exploit","published":"2018-06-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-3200","description":"The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.","exploit_maturity":"No public exploit","published":"2018-06-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-3199","description":"The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.","exploit_maturity":"No public exploit","published":"2018-06-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-12036","description":"OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.","exploit_maturity":"No public exploit","published":"2018-06-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000194","description":"A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.","exploit_maturity":"No public exploit","published":"2018-06-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-1000352","description":"In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.","exploit_maturity":"No public exploit","published":"2018-06-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-1000344","description":"In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.","exploit_maturity":"No public exploit","published":"2018-06-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-1000343","description":"In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.","exploit_maturity":"No public exploit","published":"2018-06-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-1000342","description":"In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.","exploit_maturity":"No public exploit","published":"2018-06-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-1000340","description":"In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.","exploit_maturity":"No public exploit","published":"2018-06-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-1000338","description":"In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.","exploit_maturity":"No public exploit","published":"2018-06-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1310","description":"Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for more information. The fix to upgrade the activemq-client library to 5.15.3 was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.","exploit_maturity":"No public exploit","published":"2018-05-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1131","description":"Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.","exploit_maturity":"No public exploit","published":"2018-05-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-2608","description":"Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs (SECURITY-383).","exploit_maturity":"No public exploit","published":"2018-05-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1259","description":"Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.","exploit_maturity":"No public exploit","published":"2018-05-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-2594","description":"hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root.","exploit_maturity":"No public exploit","published":"2018-05-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-2794","description":"Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162, 10 and JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, JRockit executes to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2018-04-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1308","description":"This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `\u0026dataConfig=\u003cinlinexml\u003e` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.","exploit_maturity":"No public exploit","published":"2018-04-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1272","description":"Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.","exploit_maturity":"No public exploit","published":"2018-04-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1327","description":"The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.","exploit_maturity":"No public exploit","published":"2018-03-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1316","description":"The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name was allowing directory traversal, resulting in the potential writing of files under unwanted locations, the overwriting of existing files or their deletion. This issue was addressed in Apache ODE 1.3.3 which was released in 2009, however the incorrect name CVE-2008-2370 was used on the advisory by mistake.","exploit_maturity":"No public exploit","published":"2018-03-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-15693","description":"In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are present on the classpath.","exploit_maturity":"No public exploit","published":"2018-02-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-15089","description":"It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.","exploit_maturity":"No public exploit","published":"2018-02-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1307","description":"In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use 3.3.5.","exploit_maturity":"No public exploit","published":"2018-02-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000058","description":"Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deserialization like readResolve implemented in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.","exploit_maturity":"No public exploit","published":"2018-02-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000056","description":"Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.","exploit_maturity":"No public exploit","published":"2018-02-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000055","description":"Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.","exploit_maturity":"No public exploit","published":"2018-02-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000054","description":"Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.","exploit_maturity":"No public exploit","published":"2018-02-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-1000393","description":"Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method called 'Launch agent via execution of command on master'. This allowed them to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of this launch method now requires the Run Scripts permission typically only granted to administrators.","exploit_maturity":"No public exploit","published":"2018-01-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1051","description":"It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()` in YamlProvider.","exploit_maturity":"No public exploit","published":"2018-01-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1048","description":"It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.","exploit_maturity":"No public exploit","published":"2018-01-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-1000502","description":"Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of these agents now requires the 'Run Scripts' permission typically only granted to administrators.","exploit_maturity":"No public exploit","published":"2018-01-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000012","description":"Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.","exploit_maturity":"No public exploit","published":"2018-01-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000011","description":"Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.","exploit_maturity":"No public exploit","published":"2018-01-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000010","description":"Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.","exploit_maturity":"No public exploit","published":"2018-01-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000009","description":"Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.","exploit_maturity":"No public exploit","published":"2018-01-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-1000008","description":"Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.","exploit_maturity":"No public exploit","published":"2018-01-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-5968","description":"FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.","exploit_maturity":"No public exploit","published":"2018-01-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-2637","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data as well as unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"No public exploit","published":"2018-01-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2018-2633","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2018-01-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-7536","description":"In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().","exploit_maturity":"No public exploit","published":"2018-01-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-1000498","description":"AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution","exploit_maturity":"No public exploit","published":"2018-01-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-14949","description":"Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.","exploit_maturity":"No public exploit","published":"2017-11-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-14868","description":"Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension.","exploit_maturity":"No public exploit","published":"2017-11-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-4995","description":"An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known \"deserialization gadgets.\" Spring Security configures Jackson with global default typing enabled, which means that (through the previous exploit) arbitrary code could be executed if all of the following is true: (1) Spring Security's Jackson support is being leveraged by invoking SecurityJackson2Modules.getModules(ClassLoader) or SecurityJackson2Modules.enableDefaultTyping(ObjectMapper); (2) Jackson is used to deserialize data that is not trusted (Spring Security does not perform deserialization using Jackson, so this is an explicit choice of the user); and (3) there is an unknown (Jackson is not blacklisting it already) \"deserialization gadget\" that allows code execution present on the classpath. Jackson provides a blacklisting approach to protecting against this type of attack, but Spring Security should be proactive against blocking unknown \"deserialization gadgets\" when Spring Security enables default typing.","exploit_maturity":"No public exploit","published":"2017-11-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-1000207","description":"A vulnerability in Swagger-Parser's version \u003c= 1.0.30 and Swagger codegen version \u003c= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (\u003c= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.","exploit_maturity":"No public exploit","published":"2017-11-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-1000208","description":"A vulnerability in Swagger-Parser's (version \u003c= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (\u003c= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.","exploit_maturity":"No public exploit","published":"2017-11-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-9096","description":"The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.","exploit_maturity":"Proof of concept only","published":"2017-11-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2015-0226","description":"Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.","exploit_maturity":"No public exploit","published":"2017-10-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-0115","description":"Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.","exploit_maturity":"No public exploit","published":"2017-10-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-5002","description":"XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.","exploit_maturity":"No public exploit","published":"2017-10-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-12628","description":"The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.","exploit_maturity":"No public exploit","published":"2017-10-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-10388","description":"Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: Applies to the Java SE Kerberos client. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2017-10-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-10271","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","exploit_maturity":"Exploited in the wild","published":"2017-10-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-12617","description":"When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","exploit_maturity":"Exploited in the wild","published":"2017-10-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-4434","description":"Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.","exploit_maturity":"No public exploit","published":"2017-09-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-12615","description":"When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","exploit_maturity":"Exploited in the wild","published":"2017-09-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-9805","description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","exploit_maturity":"Exploited in the wild","published":"2017-09-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-12612","description":"In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.2.0 or later.","exploit_maturity":"No public exploit","published":"2017-09-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-8744","description":"Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the classpath. This could provide an authenticated user with a means to cause the JVM running Brooklyn to load and run Java code without detection by Brooklyn. Such code would have the privileges of the Java process running Brooklyn, including the ability to open files and network connections, and execute system commands. There is known to be a proof-of-concept exploit using this vulnerability.","exploit_maturity":"No public exploit","published":"2017-09-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-3163","description":"When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.","exploit_maturity":"No public exploit","published":"2017-08-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-8752","description":"Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.","exploit_maturity":"No public exploit","published":"2017-08-29","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-7675","description":"The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.","exploit_maturity":"No public exploit","published":"2017-08-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-8739","description":"The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk.","exploit_maturity":"No public exploit","published":"2017-08-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-10147","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 8.6 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). NOTE: the previous information is from the July 2017 CPU. Oracle has not commented on third-party claims that this issue exists in the migrate functionality in the WebLogic/cluster/singleton/ServerMigrationCoordinator class and allows remote attackers to shutdown the server via a crafted T3 request.","exploit_maturity":"No public exploit","published":"2017-08-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-10118","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"No public exploit","published":"2017-08-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-10116","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2017-08-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-10115","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"No public exploit","published":"2017-08-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-10078","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting). The supported version that is affected is Java SE: 8u131. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data as well as unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"No public exploit","published":"2017-08-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-7681","description":"Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.","exploit_maturity":"No public exploit","published":"2017-07-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-1000034","description":"Akka versions \u003c=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.","exploit_maturity":"No public exploit","published":"2017-07-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-0225","description":"When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.","exploit_maturity":"No public exploit","published":"2017-05-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-3980","description":"A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a command of their choice via an authenticated ePO session.","exploit_maturity":"No public exploit","published":"2017-05-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-3531","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Servlet Runtime). Supported versions that are affected are 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 7.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L).","exploit_maturity":"No public exploit","published":"2017-04-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-3511","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded, JRockit executes to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2017-04-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-3506","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"Exploited in the wild","published":"2017-04-24","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-5661","description":"In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.","exploit_maturity":"No public exploit","published":"2017-04-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-7051","description":"XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.","exploit_maturity":"No public exploit","published":"2017-04-14","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-6816","description":"The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.","exploit_maturity":"Working exploit published","published":"2017-03-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-5643","description":"Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.","exploit_maturity":"No public exploit","published":"2017-03-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-4986","description":"Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecified parameter.","exploit_maturity":"No public exploit","published":"2017-02-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2017-3253","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 7.5 (Availability impacts).","exploit_maturity":"No public exploit","published":"2017-01-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-5546","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 7.5 (Integrity impacts).","exploit_maturity":"No public exploit","published":"2017-01-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-9878","description":"An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.","exploit_maturity":"No public exploit","published":"2016-12-29","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-9177","description":"Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.","exploit_maturity":"No public exploit","published":"2016-11-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-7065","description":"The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object.","exploit_maturity":"Working exploit published","published":"2016-10-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-4978","description":"The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.","exploit_maturity":"No public exploit","published":"2016-09-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-4974","description":"Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.","exploit_maturity":"No public exploit","published":"2016-07-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-4216","description":"XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","exploit_maturity":"No public exploit","published":"2016-07-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-1182","description":"ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.","exploit_maturity":"No public exploit","published":"2016-07-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-1181","description":"ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.","exploit_maturity":"No public exploit","published":"2016-07-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2015-0899","description":"The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.","exploit_maturity":"No public exploit","published":"2016-07-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-2174","description":"SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.","exploit_maturity":"No public exploit","published":"2016-06-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2015-7611","description":"Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.","exploit_maturity":"Working exploit published","published":"2016-06-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-2175","description":"Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.","exploit_maturity":"No public exploit","published":"2016-06-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-3674","description":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.","exploit_maturity":"No public exploit","published":"2016-05-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-3081","description":"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.","exploit_maturity":"Working exploit published","published":"2016-04-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-0710","description":"Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.","exploit_maturity":"Working exploit published","published":"2016-04-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-0709","description":"Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by \"../../webapps/x.jsp.\"","exploit_maturity":"Working exploit published","published":"2016-04-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2015-5349","description":"The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.","exploit_maturity":"No public exploit","published":"2016-04-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-2510","description":"BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.","exploit_maturity":"Forecast only","published":"2016-04-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-0792","description":"Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.","exploit_maturity":"Working exploit published","published":"2016-04-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-0752","description":"Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.","exploit_maturity":"Exploited in the wild","published":"2016-02-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-0483","description":"Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data.","exploit_maturity":"No public exploit","published":"2016-01-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2015-4868","description":"Unspecified vulnerability in Oracle Java SE 8u60 and Java SE Embedded 8u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.","exploit_maturity":"No public exploit","published":"2015-10-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-1972","description":"Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.","exploit_maturity":"No public exploit","published":"2015-08-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2015-1818","description":"XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.","exploit_maturity":"No public exploit","published":"2015-08-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2015-4748","description":"Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security.","exploit_maturity":"No public exploit","published":"2015-07-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-8125","description":"XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.","exploit_maturity":"No public exploit","published":"2015-04-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2015-0225","description":"The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.","exploit_maturity":"No public exploit","published":"2015-04-03","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2015-0254","description":"Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) \u003cx:parse\u003e or (2) \u003cx:transform\u003e JSTL XML tag.","exploit_maturity":"No public exploit","published":"2015-03-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-3490","description":"RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.","exploit_maturity":"No public exploit","published":"2014-08-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-3530","description":"The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.","exploit_maturity":"No public exploit","published":"2014-07-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-0114","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.","exploit_maturity":"Working exploit published","published":"2014-04-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-1216","description":"FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.","exploit_maturity":"Working exploit published","published":"2014-04-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-0107","description":"The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.","exploit_maturity":"No public exploit","published":"2014-04-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-0003","description":"The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.","exploit_maturity":"No public exploit","published":"2014-03-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-0002","description":"The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","exploit_maturity":"No public exploit","published":"2014-03-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-2185","description":"The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue","exploit_maturity":"No public exploit","published":"2014-01-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2012-6612","description":"The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.","exploit_maturity":"No public exploit","published":"2013-12-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-2186","description":"The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.","exploit_maturity":"Proof of concept only","published":"2013-10-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-5830","description":"Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.","exploit_maturity":"No public exploit","published":"2013-10-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-5802","description":"Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP.","exploit_maturity":"No public exploit","published":"2013-10-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-5782","description":"Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.","exploit_maturity":"No public exploit","published":"2013-10-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-4271","description":"The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221.","exploit_maturity":"No public exploit","published":"2013-10-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-4221","description":"The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.","exploit_maturity":"No public exploit","published":"2013-10-10","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-4002","description":"XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.","exploit_maturity":"No public exploit","published":"2013-07-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-2165","description":"ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.","exploit_maturity":"No public exploit","published":"2013-07-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-2461","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion Middleware R27.7.5 and earlier and R28.2.7 and earlier; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.  NOTE: the previous information is from the June and July 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass verification of XML signatures via vectors related to a \"Missing check for [a] valid DOMCanonicalizationMethod canonicalization algorithm.\"","exploit_maturity":"No public exploit","published":"2013-06-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-0140","description":"SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.","exploit_maturity":"Working exploit published","published":"2013-05-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-1537","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the default java.rmi.server.useCodebaseOnly setting of false, which allows remote attackers to perform \"dynamic class downloading\" and execute arbitrary code.","exploit_maturity":"No public exploit","published":"2013-04-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-1480","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to \"insufficient validation of raster parameters\" in awt_parseImage.c, which triggers memory corruption.","exploit_maturity":"No public exploit","published":"2013-02-02","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2012-1618","description":"Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the \"standard_conforming_strings\" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks.  NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.","exploit_maturity":"No public exploit","published":"2012-10-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2011-3556","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.","exploit_maturity":"Working exploit published","published":"2011-10-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2010-1423","description":"Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method.  NOTE: some of these details are obtained from third party information.","exploit_maturity":"Working exploit published","published":"2010-04-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2010-0386","description":"The default configuration of Sun Java System Application Server 7 and 7 2004Q2 enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing (XST) attack, a related issue to CVE-2004-2763 and CVE-2005-3398.","exploit_maturity":"No public exploit","published":"2010-01-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2009-3874","description":"Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via large subsample dimensions in a JPEG file that triggers a heap-based buffer overflow, aka Bug Id 6874643.","exploit_maturity":"No public exploit","published":"2009-11-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2009-3871","description":"Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via crafted arguments, aka Bug Id 6872358.","exploit_maturity":"No public exploit","published":"2009-11-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2009-3869","description":"Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.","exploit_maturity":"Working exploit published","published":"2009-11-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2009-3867","description":"Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.","exploit_maturity":"Working exploit published","published":"2009-11-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2009-1955","description":"The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.","exploit_maturity":"Working exploit published","published":"2009-06-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2008-5518","description":"Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.","exploit_maturity":"Working exploit published","published":"2009-04-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2009-1098","description":"Buffer overflow in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and earlier; and 1.3.1_24 and earlier allows remote attackers to access files or execute arbitrary code via a crafted GIF image, aka CR 6804998.","exploit_maturity":"No public exploit","published":"2009-03-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2009-1094","description":"Unspecified vulnerability in the LDAP implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier allows remote LDAP servers to execute arbitrary code via unknown vectors related to serialized data.","exploit_maturity":"No public exploit","published":"2009-03-25","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2008-5353","description":"The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by \"deserializing Calendar objects\".","exploit_maturity":"Working exploit published","published":"2008-12-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2008-3112","description":"Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909.","exploit_maturity":"No public exploit","published":"2008-07-09","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2008-0628","description":"The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the \"external general entities\" property is false, which allows remote attackers to conduct XML external entity (XXE) attacks and cause a denial of service or access restricted resources.","exploit_maturity":"No public exploit","published":"2008-02-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2007-5766","description":"SQL injection vulnerability in okxLOV.jsp in Oracle E-Business Suite 11 and 12 allows remote attackers to execute arbitrary SQL commands via unknown vectors.  NOTE: this is probably the same issue as CVE-2007-5527 or CVE-2007-5528, but there are insufficient details to be sure.","exploit_maturity":"No public exploit","published":"2007-11-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2007-3860","description":"Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB) 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01.  NOTE: a reliable researcher states that this is SQL injection in the wwv_flow_security.check_db_password function due to insufficient checks for '\"' characters.","exploit_maturity":"No public exploit","published":"2007-07-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2007-3504","description":"Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself.  NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.","exploit_maturity":"No public exploit","published":"2007-06-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2006-1547","description":"ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.","exploit_maturity":"Exploited in the wild","published":"2006-03-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2006-1546","description":"Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.","exploit_maturity":"No public exploit","published":"2006-03-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2006-1037","description":"SQL injection vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.","exploit_maturity":"No public exploit","published":"2006-03-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2006-0289","description":"Multiple unspecified vulnerabilities in Oracle Application Server 6.0.8.26(PS17) and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) REP05 and (2) REP06 in the Oracle Reports Developer component. NOTE: Oracle has not disputed reliable researcher claims that REP05 is the same as CVE-2005-2378 and REP06 is the same as CVE-2005-2371, both of which involve directory traversal.","exploit_maturity":"No public exploit","published":"2006-01-18","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2004-0543","description":"Multiple SQL injection vulnerabilities in Oracle Applications 11.0 and Oracle E-Business Suite 11.5.1 through 11.5.8 allow remote attackers to execute arbitrary SQL procedures and queries.","exploit_maturity":"No public exploit","published":"2004-08-06","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2004-1370","description":"Multiple SQL injection vulnerabilities in PL/SQL procedures that run with definer rights in Oracle 9i and 10g allow remote attackers to execute arbitrary SQL commands and gain privileges via (1) DBMS_EXPORT_EXTENSION, (2) WK_ACL.GET_ACL, (3) WK_ACL.STORE_ACL, (4) WK_ADM.COMPLETE_ACL_SNAPSHOT, (5) WK_ACL.DELETE_ACLS_WITH_STATEMENT, or (6) DRILOAD.VALIDATE_STMT.","exploit_maturity":"No public exploit","published":"2004-08-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2004-1364","description":"Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\\bin directory.","exploit_maturity":"Working exploit published","published":"2004-08-04","resolved":"MITIGATED-BY-RASP","severity":"High"}
]