[ {"cve_id":"CVE-2026-70906","description":"Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","exploit_maturity":"No public exploit","published":"2026-08-18","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2026-18963","description":"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.","exploit_maturity":"Working exploit published","published":"2026-08-18","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2026-44596","description":"Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.","exploit_maturity":"Working exploit published","published":"2026-07-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2026-44595","description":"Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.","exploit_maturity":"Working exploit published","published":"2026-07-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2026-41042","description":"Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino.\n\nThis issue affects Apache Gravitino: before 1.2.1.\n\nUsers are recommended to upgrade to version 1.2.1, which fixes the issue.\n\nThis issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.","exploit_maturity":"Working exploit published","published":"2026-07-08","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2026-50229","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.","exploit_maturity":"Working exploit published","published":"2026-06-29","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2026-42568","description":"Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.","exploit_maturity":"Working exploit published","published":"2026-06-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2026-44825","description":"Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account. \n\nAs an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords.\nThe future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.\n\nNot affected:\n * Clusters where bin/solr auth enable was not used to bootstrap BasicAuth\n * Clusters where template users have been assigned strong passwords after bootstrap","exploit_maturity":"Working exploit published","published":"2026-06-01","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2026-46817","description":"Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2026-05-28","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-42343","description":"A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.","exploit_maturity":"Working exploit published","published":"2026-05-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2026-33453","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component.\n\nApache Camel's camel-coap component is vulnerable to Camel message header injection, leading to remote code execution when routes forward CoAP requests to header-sensitive producers (e.g. camel-exec)\n\nThe camel-coap component maps incoming CoAP request URI query parameters directly into Camel Exchange In message headers without applying any HeaderFilterStrategy.   \nSpecifically, CamelCoapResource.handleRequest() iterates over OptionSet.getUriQuery() and calls camelExchange.getIn().setHeader(...) for every query parameter. CoAPEndpoint extends DefaultEndpoint rather than DefaultHeaderFilterStrategyEndpoint, and CoAPComponent does not implement HeaderFilterStrategyComponent; the component contains no references to HeaderFilterStrategy at all.\n\nAs a result, an unauthenticated attacker who can send a single CoAP UDP packet to a Camel route consuming from coap:// can inject arbitrary Camel internal headers (those prefixed with Camel*) into the Exchange. When the route delivers the message to a header-sensitive producer such as camel-exec, camel-sql, camel-bean, camel-file, or template components (camel-freemarker, camel-velocity), the injected headers can alter the producer's behavior. In the case of camel-exec, the CamelExecCommandExecutable and CamelExecCommandArgs headers override the executable and arguments configured on the endpoint, resulting in arbitrary OS command execution under the privileges of the Camel process.\n\nThe producer's output is written back to the Exchange body and returned in the CoAP response payload by CamelCoapResource, giving the attacker an interactive RCE channel without any need for out-of-band exfiltration.\n                                                                                                                                                                        \nExploitation prerequisites are minimal: a single unauthenticated UDP datagram to the CoAP port (default 5683). CoAP (RFC 7252) has no built-in authentication, and DTLS is optional and disabled by default. Because the protocol is UDP-based, HTTP-layer WAF/IDS controls do not apply.\nThis issue affects Apache Camel: from 4.14.0 through 4.14.5, from 4.18.0 before 4.18.1, 4.19.0.\n\nUsers are recommended to upgrade to version 4.18.1 or 4.19.0, fixing the issue.","exploit_maturity":"Working exploit published","published":"2026-04-27","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2026-40466","description":"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.\n\n\n\nAn authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.\nA malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.\nBecause Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().\n\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5.\n\nUsers are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.","exploit_maturity":"Working exploit published","published":"2026-04-24","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2026-34282","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","exploit_maturity":"No public exploit","published":"2026-04-21","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2026-40105","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-rc-1, through 16.10.15, 17.0.0-rc-1, through 17.4.7 and 17.5.0-rc-1 through 17.10.0 contain a reflected cross-site scripting vulnerability (XSS) in the comparison view between revisions of a page allows executing JavaScript code in the user's browser. If the current user is an admin, this can not only affect the current user but also the confidentiality, integrity and availability of the whole XWiki instance. If developers are unable to update immediately, they can apply the patch manually to templates/changesdoc.vm in the deployed WAR.","exploit_maturity":"Working exploit published","published":"2026-04-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2026-34486","description":"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.","exploit_maturity":"Exploited in the wild","published":"2026-04-09","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2026-22739","description":"Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.","exploit_maturity":"Working exploit published","published":"2026-03-24","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2026-24308","description":"Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.","exploit_maturity":"No public exploit","published":"2026-03-07","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2026-24281","description":"Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.","exploit_maturity":"No public exploit","published":"2026-03-07","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2026-24128","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1 through 17.4.4, and 17.5.0-rc-1 through 17.7.0 contain a reflected Cross-site Scripting (XSS) vulnerability, which allows an attacker to craft a malicious URL and execute arbitrary actions with the same privileges as the victim. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation. This issue has been patched in versions 17.8.0-rc-1, 17.4.5 and 16.10.12. To workaround, the patch can be applied manually, only a single line in templates/logging_macros.vm needs to be changed, no restart is required.","exploit_maturity":"Working exploit published","published":"2026-01-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-68161","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n * The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","exploit_maturity":"No public exploit","published":"2025-12-18","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-66472","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the \"No\" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.","exploit_maturity":"Working exploit published","published":"2025-12-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-55749","description":"XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.","exploit_maturity":"Working exploit published","published":"2025-12-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2025-5605","description":"An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure.\n\nThe known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.","exploit_maturity":"Working exploit published","published":"2025-10-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-5350","description":"SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery (SSRF). Additionally, the retrieved content was directly reflected in the HTTP response, enabling reflected cross-site scripting (XSS) in the admin user's browser context.\n\nBy tricking an administrator into accessing a crafted link, an attacker could force the server to fetch malicious content and reflect it into the admin’s browser, leading to arbitrary JavaScript execution for UI manipulation or data exfiltration. While session cookies are protected with the HttpOnly flag, the XSS still poses a significant security risk.\n\nFurthermore, SSRF can be used by a privileged user to query internal services, potentially aiding in internal network enumeration if the target endpoints are reachable from the affected product.","exploit_maturity":"Working exploit published","published":"2025-10-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-61757","description":"Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Exploited in the wild","published":"2025-10-21","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2025-61884","description":"Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Exploited in the wild","published":"2025-10-12","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2025-11580","description":"A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.","exploit_maturity":"Working exploit published","published":"2025-10-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-59474","description":"Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.","exploit_maturity":"Working exploit published","published":"2025-09-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-41243","description":"Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.\n\nAn application should be considered vulnerable when all the following are true:\n\n * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).\n * Spring Boot actuator is a dependency.\n * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.\n * The actuator endpoints are available to attackers.\n * The actuator endpoints are unsecured.","exploit_maturity":"Working exploit published","published":"2025-09-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2025-4576","description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp","exploit_maturity":"Working exploit published","published":"2025-08-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-54125","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.","exploit_maturity":"Working exploit published","published":"2025-08-06","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2025-32430","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, two templates contain reflected XSS vulnerabilities, allowing an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL. This permits the attacker to perform arbitrary actions using the permissions of the victim. This issue is fixed in versions 16.4.8, 16.10.6 and 17.3.0-rc-1. To workaround the issue, manually patch the WAR with the same changes as the original patch.","exploit_maturity":"Working exploit published","published":"2025-08-06","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.","exploit_maturity":"No public exploit","published":"2025-07-11","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-48988","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","exploit_maturity":"Forecast only","published":"2025-06-16","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2025-48976","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.","exploit_maturity":"Forecast only","published":"2025-06-16","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2025-27817","description":"A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including \"sasl.oauthbearer.token.endpoint.url\" and \"sasl.oauthbearer.jwks.endpoint.url\". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the \"sasl.oauthbearer.token.endpoint.url\" and \"sasl.oauthbearer.jwks.endpoint.url\" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. \n\nSince Apache Kafka 3.9.1/4.0.0, we have added a system property (\"-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls\") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.","exploit_maturity":"Working exploit published","published":"2025-06-10","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2025-27505","description":"GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension (e.g., rest.html). The REST API index can disclose whether certain extensions are installed. This vulnerability is fixed in 2.26.3 and 2.25.6. As a workaround, in ${GEOSERVER_DATA_DIR}/security/config.xml, change the paths for the rest filter to /rest.*,/rest/** and change the paths for the gwc filter to /gwc/rest.*,/gwc/rest/** and restart GeoServer.","exploit_maturity":"Working exploit published","published":"2025-06-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2024-29198","description":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue.","exploit_maturity":"Working exploit published","published":"2025-06-10","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2025-48734","description":"Improper Access Control vulnerability in Apache Commons.\n\n\n\nA special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.\n\n\n\n\n\nReleases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().\nStarting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.\n\nThis issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils\n\n 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.\n\n\nUsers of the artifact org.apache.commons:commons-beanutils2\n\n 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.","exploit_maturity":"Proof of concept only","published":"2025-05-28","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-13009","description":"In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request\nbody. This can result in corrupted and/or inadvertent sharing of data between requests.","exploit_maturity":"No public exploit","published":"2025-05-08","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2025-27533","description":"Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.\n\nDuring unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections.\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.\n\nUsers are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.\n\nExisting users may implement mutual TLS to mitigate the risk on affected brokers.","exploit_maturity":"Working exploit published","published":"2025-05-07","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-4388","description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.","exploit_maturity":"Working exploit published","published":"2025-05-06","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-46554","description":"XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering for the results depending on current user rights, meaning an unauthenticated user could exploit this even in a private wiki. This issue has been patched in versions 14.10.22, 15.10.12, 16.4.3, and 16.7.0.","exploit_maturity":"Working exploit published","published":"2025-04-30","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-32970","description":"XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0, an open redirect vulnerability in the HTML conversion request filter allows attackers to construct URLs on an XWiki instance that redirects to any URL. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0.","exploit_maturity":"Working exploit published","published":"2025-04-30","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-31672","description":"Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (including the path) in the zip. In this case, products reading the affected file could read different data because 1 of the zip entries with the duplicate name is selected over another but different products may choose a different zip entry.\nThis issue affects Apache POI poi-ooxml before 5.4.0. poi-ooxml 5.4.0 has a check that throws an exception if zip entries with duplicate file names are found in the input file.\nUsers are recommended to upgrade to version poi-ooxml 5.4.0, which fixes the issue. Please read https://poi.apache.org/security.html for recommendations about how to use the POI libraries securely.","exploit_maturity":"No public exploit","published":"2025-04-09","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2024-56325","description":"Authentication Bypass Issue\n\nIf the path does not contain / and contain., authentication is not required.\n\nExpected Normal Request and Response Example\n\ncurl -X POST -H \"Content-Type: application/json\" -d {\\\"username\\\":\\\"hack2\\\",\\\"password\\\":\\\"hack\\\",\\\"component\\\":\\\"CONTROLLER\\\",\\\"role\\\":\\\"ADMIN\\\",\\\"tables\\\":[],\\\"permissions\\\":[],\\\"usernameWithComponent\\\":\\\"hack_CONTROLLER\\\"} http://{server_ip}:9000/users \n\n\nReturn: {\"code\":401,\"error\":\"HTTP 401 Unauthorized\"}\n\n\nMalicious Request and Response Example \n\ncurl -X POST -H \"Content-Type: application/json\" -d '{\\\"username\\\":\\\"hack\\\",\\\"password\\\":\\\"hack\\\",\\\"component\\\":\\\"CONTROLLER\\\",\\\"role\\\":\\\"ADMIN\\\",\\\"tables\\\":[],\\\"permissions\\\":[],\\\"usernameWithComponent\\\":\\\"hack_CONTROLLER\\\"}' http://{serverip}:9000/users; http://{serverip}:9000/users; .\n\n\nReturn: {\"users\":{}}\n\n\n\n \n\nA new user gets added bypassing authentication, enabling the user to control Pinot.","exploit_maturity":"Working exploit published","published":"2025-04-01","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2025-27888","description":"Severity: medium (5.8) / important\n\nServer-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid.\n\nThis issue affects all previous Druid versions.\n\n\nWhen using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected.\n\n\nUsers are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.","exploit_maturity":"Working exploit published","published":"2025-03-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2025-29925","description":"XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with \"Prevent unregistered user to view pages\": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.","exploit_maturity":"Working exploit published","published":"2025-03-19","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2025-24893","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `\u003chost\u003e/xwiki/bin/get/Main/SolrSearch?media=rss\u0026text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28\"Hello%20from\"%20%2B%20\"%20search%20text%3A\"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.","exploit_maturity":"Exploited in the wild","published":"2025-02-20","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2025-24970","description":"Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.","exploit_maturity":"Proof of concept only","published":"2025-02-10","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2025-23184","description":"A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).","exploit_maturity":"No public exploit","published":"2025-01-21","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-56512","description":"Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups.\n\nCreating a new Process Group can include binding to a Parameter Context, but in cases where the Process Group did not reference any Parameter values, the framework did not check user authorization for the bound Parameter Context. Missing authorization for a bound Parameter Context enabled clients to download non-sensitive Parameter values after creating the Process Group.\n\nCreating a new Process Group can also include referencing existing Controller Services or Parameter Providers. The framework did not check user authorization for referenced Controller Services or Parameter Providers, enabling clients to create Process Groups and use these components that were otherwise unauthorized.\n\nThis vulnerability is limited in scope to authenticated users authorized to create Process Groups. The scope is further limited to deployments with component-based authorization policies. Upgrading to Apache NiFi 2.1.0 is the recommended mitigation, which includes authorization checking for Parameter and Controller Service references on Process Group creation.","exploit_maturity":"Working exploit published","published":"2024-12-28","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2024-43441","description":"Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server.\n\nThis issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0.\n\nUsers are recommended to upgrade to version 1.5.0, which fixes the issue.","exploit_maturity":"Working exploit published","published":"2024-12-24","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2024-47606","description":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem-\u003eallocator-\u003emem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.","exploit_maturity":"No public exploit","published":"2024-12-12","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-38820","description":"The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.","exploit_maturity":"No public exploit","published":"2024-10-18","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2024-45216","description":"Improper Authentication vulnerability in Apache Solr.\n\nSolr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.\nA fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.\nThis fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.\n\n\nThis issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.\n\nUsers are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.","exploit_maturity":"Working exploit published","published":"2024-10-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2024-3656","description":"A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.","exploit_maturity":"Working exploit published","published":"2024-10-09","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-8883","description":"A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.","exploit_maturity":"Working exploit published","published":"2024-09-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2024-8698","description":"A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.","exploit_maturity":"Working exploit published","published":"2024-09-19","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-7254","description":"Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.","exploit_maturity":"No public exploit","published":"2024-09-19","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-45591","description":"XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private. On a private wiki, this can be tested by accessing /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history, if this shows the history of the main page then the installation is vulnerable. This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.","exploit_maturity":"Working exploit published","published":"2024-09-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2024-30188","description":"File read and write vulnerability in Apache DolphinScheduler ,  authenticated users can illegally access additional resource files.\nThis issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2.\n\nUsers are recommended to upgrade to version 3.2.2, which fixes the issue.","exploit_maturity":"Working exploit published","published":"2024-08-12","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-41947","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.","exploit_maturity":"Working exploit published","published":"2024-07-31","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2024-41667","description":"OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to override the default OpenAM login, they did not restrict the `CustomLoginUrlTemplate`, allowing it to be set freely. Commit fcb8432aa77d5b2e147624fe954cb150c568e0b8 introduces `TemplateClassResolver.SAFER_RESOLVER` to disable the resolution of commonly exploited classes in FreeMarker template injection. As of time of publication, this fix is expected to be part of version 15.0.4.","exploit_maturity":"Working exploit published","published":"2024-07-24","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-32007","description":"An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. \n","exploit_maturity":"No public exploit","published":"2024-07-19","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-29736","description":"A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.","exploit_maturity":"No public exploit","published":"2024-07-19","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2024-21136","description":"Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are affected are 19.0.5, 20.0.3, 20.0.4, 22.0.0 and 23.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office. While the vulnerability is in Oracle Retail Xstore Office, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Xstore Office accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2024-07-16","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-34750","description":"Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.","exploit_maturity":"No public exploit","published":"2024-07-03","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-36404","description":"GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.","exploit_maturity":"Working exploit published","published":"2024-07-02","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2024-36401","description":"GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.\n\nThe GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code.\n\nVersions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.","exploit_maturity":"Exploited in the wild","published":"2024-07-01","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2024-29868","description":"Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism.\nThis allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account.\nThis issue affects Apache StreamPipes: from 0.69.0 through 0.93.0.\n\nUsers are recommended to upgrade to version 0.95.0, which fixes the issue.\n\n","exploit_maturity":"Working exploit published","published":"2024-06-24","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2024-29857","description":"An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.","exploit_maturity":"No public exploit","published":"2024-05-14","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-32114","description":"In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).\nIt means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).\n\nTo mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:\n\u003cbean id=\"securityConstraintMapping\" class=\"org.eclipse.jetty.security.ConstraintMapping\"\u003e\n  \u003cproperty name=\"constraint\" ref=\"securityConstraint\" /\u003e\n  \u003cproperty name=\"pathSpec\" value=\"/\" /\u003e\n\u003c/bean\u003e\n\nOr we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.\n","exploit_maturity":"Working exploit published","published":"2024-05-02","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-31982","description":"XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may manually apply the patch to the page `Main.DatabaseSearch`. Alternatively, unless database search is explicitly used by users, this page can be deleted as this is not the default search interface of XWiki.","exploit_maturity":"Working exploit published","published":"2024-04-10","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2024-29025","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.","exploit_maturity":"Proof of concept only","published":"2024-03-25","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2024-29133","description":"Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.\n\nUsers are recommended to upgrade to version 2.10.1, which fixes the issue.","exploit_maturity":"No public exploit","published":"2024-03-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2024-29131","description":"Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.\n\nUsers are recommended to upgrade to version 2.10.1, which fixes the issue.","exploit_maturity":"No public exploit","published":"2024-03-21","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-28752","description":"A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.","exploit_maturity":"No public exploit","published":"2024-03-15","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2024-28253","description":"OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. `CompiledRule::validateExpression` is also called from `PolicyRepository.prepare`. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and therefore after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/policies` which gets handled by `PolicyResource.createOrUpdate()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-252`. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","exploit_maturity":"Working exploit published","published":"2024-03-15","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2024-24549","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.","exploit_maturity":"Proof of concept only","published":"2024-03-13","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-23672","description":"Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.","exploit_maturity":"No public exploit","published":"2024-03-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2024-22871","description":"An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.","exploit_maturity":"Proof of concept only","published":"2024-02-29","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-51775","description":"The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","exploit_maturity":"Proof of concept only","published":"2024-02-29","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2024-22201","description":"Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.","exploit_maturity":"Proof of concept only","published":"2024-02-26","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2024-25608","description":"HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.","exploit_maturity":"Working exploit published","published":"2024-02-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2024-26308","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.\n\nUsers are recommended to upgrade to version 1.26, which fixes the issue.","exploit_maturity":"No public exploit","published":"2024-02-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2024-25710","description":"Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.\n\nUsers are recommended to upgrade to version 1.26.0 which fixes the issue.","exploit_maturity":"No public exploit","published":"2024-02-19","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-52428","description":"In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.","exploit_maturity":"No public exploit","published":"2024-02-11","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-50290","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.\nThe Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.\n\nThe Solr Metrics API is protected by the \"metrics-read\" permission.\nTherefore, Solr Clouds with Authorization setup will only be vulnerable via users with the \"metrics-read\" permission.\nThis issue affects Apache Solr: from 9.0.0 before 9.3.0.\n\nUsers are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.\n\n","exploit_maturity":"Working exploit published","published":"2024-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2024-21650","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the \"first name\" or \"last name\" fields during user registration. This impacts all installations that have user registration enabled for guests. This vulnerability has been patched in XWiki 14.10.17, 15.5.3 and 15.8 RC1.","exploit_maturity":"Working exploit published","published":"2024-01-08","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-50720","description":"XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for `objcontent:email*` using XWiki's regular search interface. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. There are no known workarounds for this vulnerability.\n","exploit_maturity":"Working exploit published","published":"2023-12-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-50719","description":"XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren't accessible but this vulnerability would disclose them as plain text. This has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. There are no known workarounds for this vulnerability.\n","exploit_maturity":"Working exploit published","published":"2023-12-15","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-6379","description":"Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially take control of their browsing session.","exploit_maturity":"Working exploit published","published":"2023-12-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-46589","description":"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.","exploit_maturity":"No public exploit","published":"2023-11-28","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-33202","description":"Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)","exploit_maturity":"No public exploit","published":"2023-11-23","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-48292","description":"The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document `Admin.RunShellCommand` can also be deleted if the possibility to run shell commands isn't needed.","exploit_maturity":"Working exploit published","published":"2023-11-20","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-48241","description":"XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes the content of all documents of all wikis to anybody who has access to it, by default it is public. This exposes all information stored in the wiki (but not some protected information like password hashes). While there is a right check normally, the right check can be circumvented by explicitly requesting fields from Solr that don't include the data for the right check. This has been fixed in XWiki 15.6RC1, 15.5.1 and 14.10.15 by not listing documents whose rights cannot be checked. No known workarounds are available.","exploit_maturity":"Working exploit published","published":"2023-11-20","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-46337","description":"A cleverly devised username might bypass LDAP authentication checks. In \nLDAP-authenticated Derby installations, this could let an attacker fill \nup the disk by creating junk Derby databases. In LDAP-authenticated \nDerby installations, this could also allow the attacker to execute \nmalware which was visible to and executable by the account which booted \nthe Derby server. In LDAP-protected databases which weren't also \nprotected by SQL GRANT/REVOKE authorization, this vulnerability could \nalso let an attacker view and corrupt sensitive data and run sensitive \ndatabase functions and procedures.\n\nMitigation:\n\nUsers should upgrade to Java 21 and Derby 10.17.1.0.\n\nAlternatively, users who wish to remain on older Java versions should \nbuild their own Derby distribution from one of the release families to \nwhich the fix was backported: 10.16, 10.15, and 10.14. Those are the \nreleases which correspond, respectively, with Java LTS versions 17, 11, \nand 8.\n\n","exploit_maturity":"No public exploit","published":"2023-11-20","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-6038","description":"A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.","exploit_maturity":"Working exploit published","published":"2023-11-16","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-46732","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting (RXSS) via the `rev` parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14. The patch in commit `04e325d57` can be manually applied without upgrading (or restarting) the instance. Users are advised to upgrade or to manually apply the patch. There are no known workarounds for this vulnerability.","exploit_maturity":"Working exploit published","published":"2023-11-06","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-4043","description":"In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.\n\n\nTo mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.\n\n\n","exploit_maturity":"No public exploit","published":"2023-11-03","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-45136","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy (disabled by default), XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflected cross-site scripting attack in the page creation form. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation. This has been patched in XWiki 14.10.12 and 15.5-rc-1 by adding appropriate escaping. The vulnerable template file `createinline.vm` is part of XWiki's WAR and can be patched by manually applying the changes from the fix.","exploit_maturity":"Working exploit published","published":"2023-10-25","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-43795","description":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service (WPS) specification is designed to process information from any server using GET and POST requests. This presents the opportunity for Server Side Request Forgery. This vulnerability has been patched in version 2.22.5 and 2.23.2.","exploit_maturity":"Working exploit published","published":"2023-10-25","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-22081","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","exploit_maturity":"No public exploit","published":"2023-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-5072","description":"Denial of Service in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.","exploit_maturity":"No public exploit","published":"2023-10-12","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-45648","description":"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially \ncrafted, invalid trailer header could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.","exploit_maturity":"Working exploit published","published":"2023-10-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-44487","description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","exploit_maturity":"Exploited in the wild","published":"2023-10-10","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-42795","description":"Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could \ncause Tomcat to skip some parts of the recycling process leading to \ninformation leaking from the current request/response to the next.\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.","exploit_maturity":"No public exploit","published":"2023-10-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-42794","description":"Incomplete Cleanup vulnerability in Apache Tomcat.\n\nThe internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, \nin progress refactoring that exposed a potential denial of service on \nWindows if a web application opened a stream for an uploaded file but \nfailed to close the stream. The file would never be deleted from disk \ncreating the possibility of an eventual denial of service due to the \ndisk being full.\n\nOther, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.","exploit_maturity":"No public exploit","published":"2023-10-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-4911","description":"A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.","exploit_maturity":"Exploited in the wild","published":"2023-10-03","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-40167","description":"Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.","exploit_maturity":"No public exploit","published":"2023-09-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-42503","description":"Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0.\n\nUsers are recommended to upgrade to version 1.24.0, which fixes the issue.\n\nA third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption.\n\nIn version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds and subsecond precision (for example “1647221103.5998539”). The impacted fields are “atime”, “ctime”, “mtime” and “LIBARCHIVE.creationtime”. No input validation is performed prior to the parsing of header values.\n\nParsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as “9e9999999”) within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098 [5].\n\n[1]: https://issues.apache.org/jira/browse/COMPRESS-612 \n[2]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 \n[3]: https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html \n[4]: https://bugs.openjdk.org/browse/JDK-6560193 \n[5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098 \n\nOnly applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.","exploit_maturity":"No public exploit","published":"2023-09-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-4759","description":"Arbitrary File Overwrite in Eclipse JGit \u003c= 6.6.0\n\nIn Eclipse JGit, all versions \u003c= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem.\n\nThis can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command.\n\nThe issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration.\n\nSetting git configuration option core.symlinks = false before checking out avoids the problem.\n\nThe issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/  and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from 5.13.3.202401111512-r.\n\n\nThe JGit maintainers would like to thank RyotaK for finding and reporting this issue.\n\n\n\n","exploit_maturity":"No public exploit","published":"2023-09-12","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-44729","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\n\nOn version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.","exploit_maturity":"No public exploit","published":"2023-08-22","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-4136","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.","exploit_maturity":"Working exploit published","published":"2023-08-03","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-3990","description":"A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.","exploit_maturity":"Working exploit published","published":"2023-07-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-22047","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2023-07-18","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-37462","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to manually patch their installations.","exploit_maturity":"Working exploit published","published":"2023-07-14","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-37582","description":"The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. \n\nWhen NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. \n\nIt is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.","exploit_maturity":"Working exploit published","published":"2023-07-12","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-33201","description":"Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.","exploit_maturity":"No public exploit","published":"2023-07-05","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-35162","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: \u003e \u003chostname\u003e/xwiki/bin/get/FlamingoThemes/Cerulean xpage=xpart\u0026vm=previewactions.vm\u0026xcontinue=javascript:alert(document.domain). This vulnerability exists since XWiki 6.1-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-35161","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as: \u003e xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu\u0026resolve=true\u0026xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.2-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.\n","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-35160","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as: \u003e xwiki/bin/view/XWiki/Main xpage=resubmit\u0026resubmit=javascript:alert(document.domain)\u0026xback=javascript:alert(document.domain). This vulnerability exists since XWiki 2.5-milestone-2. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-35159","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: \u003e xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-35158","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: \u003e /xwiki/bin/view/XWiki/Main?xpage=restore\u0026showBatch=true\u0026xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 9.4-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. ","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-35156","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: \u003e xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart\u0026vm=delete.vm\u0026xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability. \n","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-35155","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). For instance, the following URL execute an `alter` on the browser: `\u003cxwiki-host\u003e/xwiki/bin/view/Main/?viewer=share\u0026send=1\u0026target=\u0026target=%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Crenniepak%40intigriti.me%3E\u0026includeDocument=inline\u0026message=I+wanted+to+share+this+page+with+you.`, where `\u003cxwiki-host\u003e` is the URL of your XWiki installation. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8.\n","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-34462","description":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.","exploit_maturity":"No public exploit","published":"2023-06-22","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-35116","description":"jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.","exploit_maturity":"No public exploit","published":"2023-06-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-34609","description":"An issue was discovered flexjson thru 3.3 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.","exploit_maturity":"Proof of concept only","published":"2023-06-14","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-33510","description":"Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.","exploit_maturity":"Working exploit published","published":"2023-06-07","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-33246","description":"For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. \n\nSeveral components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. \n\nTo prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .","exploit_maturity":"Exploited in the wild","published":"2023-05-24","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-28709","description":"The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.","exploit_maturity":"No public exploit","published":"2023-05-22","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-32068","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki 12.10.7 and 13.3RC1 but there is still the possibility to force specific URLs to skip some checks, e.g. using URLs like `http:example.com` in the parameter would allow the redirect. The issue has now been patched against all patterns that are known for performing redirects. This issue has been patched in XWiki 14.10.4 and 15.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","exploit_maturity":"Working exploit published","published":"2023-05-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-29923","description":"PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.","exploit_maturity":"Working exploit published","published":"2023-04-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-29922","description":"PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.","exploit_maturity":"Working exploit published","published":"2023-04-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-26049","description":"Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `\"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE=\"b; JSESSIONID=1337; c=d\"` will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14, 11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue.","exploit_maturity":"No public exploit","published":"2023-04-18","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-29506","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.","exploit_maturity":"Working exploit published","published":"2023-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-29204","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.\n","exploit_maturity":"Working exploit published","published":"2023-04-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-20863","description":"In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.","exploit_maturity":"No public exploit","published":"2023-04-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-26119","description":"Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.","exploit_maturity":"No public exploit","published":"2023-04-03","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2022-43939","description":"Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.","exploit_maturity":"Exploited in the wild","published":"2023-04-03","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2022-43769","description":"Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.","exploit_maturity":"Exploited in the wild","published":"2023-04-03","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-28462","description":"A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server once a JNDI directory scan is performed.","exploit_maturity":"No public exploit","published":"2023-03-30","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2023-28708","description":"When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.\n\nOlder, EOL versions may also be affected.","exploit_maturity":"No public exploit","published":"2023-03-22","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2023-1436","description":"An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.\n\n","exploit_maturity":"Proof of concept only","published":"2023-03-22","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-1370","description":"[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib.\n\nWhen reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively.\n\nIt was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.","exploit_maturity":"Proof of concept only","published":"2023-03-22","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-24998","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\n\n\n\n\nNote that, like all of the file upload limits, the\n new configuration option (FileUploadBase#setFileCountMax) is not\n enabled by default and must be explicitly configured.","exploit_maturity":"No public exploit","published":"2023-02-20","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-37305","description":"An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin.","exploit_maturity":"Working exploit published","published":"2023-02-03","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-37304","description":"An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.","exploit_maturity":"Working exploit published","published":"2023-02-03","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2023-0091","description":"A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.","exploit_maturity":"No public exploit","published":"2023-01-13","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2022-45143","description":"The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.","exploit_maturity":"No public exploit","published":"2023-01-03","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-46364","description":"A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. ","exploit_maturity":"Proof of concept only","published":"2022-12-13","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2022-45693","description":"Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.","exploit_maturity":"Proof of concept only","published":"2022-12-13","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-45688","description":"A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.","exploit_maturity":"Proof of concept only","published":"2022-12-13","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-45685","description":"A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.","exploit_maturity":"No public exploit","published":"2022-12-13","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-41915","description":"Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator\u003c?\u003e)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.","exploit_maturity":"Proof of concept only","published":"2022-12-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2022-41881","description":"Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.","exploit_maturity":"Proof of concept only","published":"2022-12-12","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-3510","description":"A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.\n\n","exploit_maturity":"No public exploit","published":"2022-12-12","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-3509","description":"A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.","exploit_maturity":"No public exploit","published":"2022-12-12","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-45868","description":"The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states \"This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that.\" Nonetheless, the issue was fixed in 2.2.220.","exploit_maturity":"Proof of concept only","published":"2022-11-23","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-42118","description":"A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.","exploit_maturity":"Working exploit published","published":"2022-11-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2022-42252","description":"If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.","exploit_maturity":"No public exploit","published":"2022-11-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-42890","description":"A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.","exploit_maturity":"No public exploit","published":"2022-10-25","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-42003","description":"In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.","exploit_maturity":"No public exploit","published":"2022-10-02","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-41237","description":"Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.","exploit_maturity":"No public exploit","published":"2022-09-21","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2022-40150","description":"Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.","exploit_maturity":"No public exploit","published":"2022-09-16","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-1259","description":"A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.","exploit_maturity":"No public exploit","published":"2022-08-31","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-36537","description":"ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.","exploit_maturity":"Exploited in the wild","published":"2022-08-26","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-4040","description":"A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.","exploit_maturity":"No public exploit","published":"2022-08-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2022-36883","description":"A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.","exploit_maturity":"Working exploit published","published":"2022-07-27","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-32430","description":"An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application.","exploit_maturity":"Working exploit published","published":"2022-07-21","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-31160","description":"jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( \"refresh\" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.","exploit_maturity":"Proof of concept only","published":"2022-07-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-43116","description":"An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.","exploit_maturity":"Working exploit published","published":"2022-07-05","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-29599","description":"In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.","exploit_maturity":"No public exploit","published":"2022-05-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2022-24823","description":"Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.","exploit_maturity":"Proof of concept only","published":"2022-05-06","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-40822","description":"GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.","exploit_maturity":"Working exploit published","published":"2022-05-02","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-29546","description":"HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.","exploit_maturity":"No public exploit","published":"2022-04-25","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-28366","description":"Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.","exploit_maturity":"No public exploit","published":"2022-04-21","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-24816","description":"JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.","exploit_maturity":"Exploited in the wild","published":"2022-04-13","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2021-31805","description":"The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.","exploit_maturity":"Working exploit published","published":"2022-04-12","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2022-24839","description":"org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `\u003e= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.","exploit_maturity":"No public exploit","published":"2022-04-11","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-24819","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.","exploit_maturity":"Working exploit published","published":"2022-04-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-20323","description":"A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.","exploit_maturity":"Working exploit published","published":"2022-03-25","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-36518","description":"jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.","exploit_maturity":"No public exploit","published":"2022-03-11","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-22947","description":"In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.","exploit_maturity":"Exploited in the wild","published":"2022-03-03","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2021-3560","description":"It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","exploit_maturity":"Exploited in the wild","published":"2022-02-16","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2022-23944","description":"User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.","exploit_maturity":"Working exploit published","published":"2022-01-25","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2021-42392","description":"The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.","exploit_maturity":"Proof of concept only","published":"2022-01-10","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2021-22569","description":"An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.","exploit_maturity":"Proof of concept only","published":"2022-01-10","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-44549","description":"Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of \"man in the middle\" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429","exploit_maturity":"No public exploit","published":"2021-12-14","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-42567","description":"Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.","exploit_maturity":"Working exploit published","published":"2021-12-07","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-22053","description":"Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.","exploit_maturity":"Working exploit published","published":"2021-11-19","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-37580","description":"A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0","exploit_maturity":"Working exploit published","published":"2021-11-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2021-42697","description":"Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.","exploit_maturity":"Working exploit published","published":"2021-11-02","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-36749","description":"In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.","exploit_maturity":"Working exploit published","published":"2021-09-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-40690","description":"All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the \"secureValidation\" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.","exploit_maturity":"No public exploit","published":"2021-09-19","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-41079","description":"Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.","exploit_maturity":"No public exploit","published":"2021-09-16","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-23413","description":"This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.","exploit_maturity":"No public exploit","published":"2021-07-25","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-22145","description":"A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.","exploit_maturity":"Working exploit published","published":"2021-07-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-36374","description":"When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.","exploit_maturity":"No public exploit","published":"2021-07-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-36090","description":"When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.","exploit_maturity":"No public exploit","published":"2021-07-13","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-30640","description":"A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.","exploit_maturity":"No public exploit","published":"2021-07-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-28169","description":"For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.","exploit_maturity":"Working exploit published","published":"2021-06-09","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-31684","description":"A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.","exploit_maturity":"No public exploit","published":"2021-06-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-23017","description":"A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.","exploit_maturity":"Working exploit published","published":"2021-06-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-33562","description":"A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.","exploit_maturity":"Working exploit published","published":"2021-05-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-33561","description":"A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend, e.g., in admin/customers/list.html.","exploit_maturity":"Working exploit published","published":"2021-05-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-15522","description":"Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.","exploit_maturity":"No public exploit","published":"2021-05-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-29442","description":"Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)","exploit_maturity":"Working exploit published","published":"2021-04-27","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-29441","description":"Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.","exploit_maturity":"Working exploit published","published":"2021-04-27","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2021-28168","description":"Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.","exploit_maturity":"No public exploit","published":"2021-04-22","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2021-27905","description":"The ReplicationHandler (normally registered at \"/replication\" under a Solr core) in Apache Solr has a \"masterUrl\" (also \"leaderUrl\" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the \"shards\" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.","exploit_maturity":"Working exploit published","published":"2021-04-13","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2021-21409","description":"Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.","exploit_maturity":"No public exploit","published":"2021-03-30","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-13936","description":"An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.","exploit_maturity":"No public exploit","published":"2021-03-10","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-21295","description":"Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.","exploit_maturity":"No public exploit","published":"2021-03-09","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-27838","description":"A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.","exploit_maturity":"Working exploit published","published":"2021-03-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-28491","description":"This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.","exploit_maturity":"No public exploit","published":"2021-02-18","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-25646","description":"Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.","exploit_maturity":"Working exploit published","published":"2021-01-29","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-26117","description":"The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.","exploit_maturity":"No public exploit","published":"2021-01-27","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2021-22132","description":"Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2","exploit_maturity":"No public exploit","published":"2021-01-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-36183","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.","exploit_maturity":"No public exploit","published":"2021-01-07","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-36182","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.","exploit_maturity":"No public exploit","published":"2021-01-07","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-36180","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.","exploit_maturity":"No public exploit","published":"2021-01-07","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-36179","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.","exploit_maturity":"Proof of concept only","published":"2021-01-07","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-36189","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.","exploit_maturity":"No public exploit","published":"2021-01-06","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-36187","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.","exploit_maturity":"No public exploit","published":"2021-01-06","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-36186","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.","exploit_maturity":"No public exploit","published":"2021-01-06","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-36185","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.","exploit_maturity":"No public exploit","published":"2021-01-06","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-36184","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.","exploit_maturity":"Proof of concept only","published":"2021-01-06","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-36181","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.","exploit_maturity":"No public exploit","published":"2021-01-06","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-35774","description":"server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.","exploit_maturity":"Working exploit published","published":"2020-12-29","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-35728","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).","exploit_maturity":"Proof of concept only","published":"2020-12-27","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-28052","description":"An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.","exploit_maturity":"No public exploit","published":"2020-12-18","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-35491","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.","exploit_maturity":"No public exploit","published":"2020-12-17","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-35490","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.","exploit_maturity":"No public exploit","published":"2020-12-17","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-10770","description":"A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.","exploit_maturity":"Working exploit published","published":"2020-12-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-8908","description":"A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.","exploit_maturity":"No public exploit","published":"2020-12-10","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2020-13942","description":"It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.","exploit_maturity":"Working exploit published","published":"2020-11-24","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2020-14781","description":"Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","exploit_maturity":"No public exploit","published":"2020-10-21","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2020-13937","description":"Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.","exploit_maturity":"Working exploit published","published":"2020-10-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-7318","description":"Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.","exploit_maturity":"Working exploit published","published":"2020-10-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-13951","description":"Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.","exploit_maturity":"Working exploit published","published":"2020-09-30","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-23814","description":"Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.","exploit_maturity":"Working exploit published","published":"2020-09-03","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-24616","description":"FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).","exploit_maturity":"No public exploit","published":"2020-08-25","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-2231","description":"Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.","exploit_maturity":"Working exploit published","published":"2020-08-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-2230","description":"Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.","exploit_maturity":"Working exploit published","published":"2020-08-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-2229","description":"Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.","exploit_maturity":"Working exploit published","published":"2020-08-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-5412","description":"Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.","exploit_maturity":"Working exploit published","published":"2020-08-07","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-14573","description":"Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","exploit_maturity":"No public exploit","published":"2020-07-15","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2020-13935","description":"The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.","exploit_maturity":"Working exploit published","published":"2020-07-14","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-9480","description":"In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).","exploit_maturity":"Working exploit published","published":"2020-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2020-14062","description":"FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).","exploit_maturity":"No public exploit","published":"2020-06-14","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-14061","description":"FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).","exploit_maturity":"No public exploit","published":"2020-06-14","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-14060","description":"FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).","exploit_maturity":"No public exploit","published":"2020-06-14","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-11975","description":"Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.","exploit_maturity":"Working exploit published","published":"2020-06-05","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2020-2733","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2020-04-15","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2020-11620","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).","exploit_maturity":"No public exploit","published":"2020-04-07","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-11619","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).","exploit_maturity":"No public exploit","published":"2020-04-07","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-10204","description":"Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.","exploit_maturity":"Working exploit published","published":"2020-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-10199","description":"Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).","exploit_maturity":"Exploited in the wild","published":"2020-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-11113","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).","exploit_maturity":"No public exploit","published":"2020-03-31","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-11112","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).","exploit_maturity":"No public exploit","published":"2020-03-31","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-11111","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).","exploit_maturity":"No public exploit","published":"2020-03-31","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-10969","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.","exploit_maturity":"No public exploit","published":"2020-03-26","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-10968","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).","exploit_maturity":"No public exploit","published":"2020-03-26","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-10673","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).","exploit_maturity":"Proof of concept only","published":"2020-03-18","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-10672","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).","exploit_maturity":"No public exploit","published":"2020-03-18","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-2140","description":"Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.","exploit_maturity":"Working exploit published","published":"2020-03-09","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-9548","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).","exploit_maturity":"Working exploit published","published":"2020-03-02","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2020-9547","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).","exploit_maturity":"Working exploit published","published":"2020-03-02","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2020-9546","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).","exploit_maturity":"No public exploit","published":"2020-03-02","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-14893","description":"A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.","exploit_maturity":"No public exploit","published":"2020-03-02","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-14892","description":"A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.","exploit_maturity":"No public exploit","published":"2020-03-02","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2020-8840","description":"FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.","exploit_maturity":"Proof of concept only","published":"2020-02-10","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2020-2103","description":"Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.","exploit_maturity":"Working exploit published","published":"2020-01-29","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-20445","description":"HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.","exploit_maturity":"No public exploit","published":"2020-01-29","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-20444","description":"HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an \"invalid fold.\"","exploit_maturity":"No public exploit","published":"2020-01-29","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2020-7934","description":"In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.","exploit_maturity":"Working exploit published","published":"2020-01-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2020-7226","description":"CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with \"new byte\" may depend on untrusted input within the header of encoded data.","exploit_maturity":"No public exploit","published":"2020-01-24","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2020-2096","description":"Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.","exploit_maturity":"Working exploit published","published":"2020-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-20330","description":"FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.","exploit_maturity":"No public exploit","published":"2020-01-03","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-17558","description":"Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","exploit_maturity":"Exploited in the wild","published":"2019-12-30","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2012-1592","description":"A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.","exploit_maturity":"Working exploit published","published":"2019-12-05","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2013-5123","description":"The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.","exploit_maturity":"Working exploit published","published":"2019-11-05","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2011-3923","description":"Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.","exploit_maturity":"Working exploit published","published":"2019-11-01","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-18394","description":"A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.","exploit_maturity":"Working exploit published","published":"2019-10-24","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-10475","description":"A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.","exploit_maturity":"Working exploit published","published":"2019-10-23","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-3025","description":"Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications. The supported version that is affected is 5.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality RES 3700. While the vulnerability is in Oracle Hospitality RES 3700, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality RES 3700. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2019-10-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-17531","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.","exploit_maturity":"No public exploit","published":"2019-10-12","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-17359","description":"The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.","exploit_maturity":"No public exploit","published":"2019-10-08","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2019-17267","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.","exploit_maturity":"No public exploit","published":"2019-10-07","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-16943","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.","exploit_maturity":"No public exploit","published":"2019-10-01","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-16942","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.","exploit_maturity":"No public exploit","published":"2019-10-01","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-16869","description":"Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a \"Transfer-Encoding : chunked\" line), which leads to HTTP request smuggling.","exploit_maturity":"No public exploit","published":"2019-09-26","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2019-10405","description":"Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the \"Cookie\" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.","exploit_maturity":"Working exploit published","published":"2019-09-25","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-16335","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.","exploit_maturity":"No public exploit","published":"2019-09-15","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-14540","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.","exploit_maturity":"Proof of concept only","published":"2019-09-15","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-12402","description":"The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.","exploit_maturity":"No public exploit","published":"2019-08-30","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2019-13236","description":"In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.","exploit_maturity":"Working exploit published","published":"2019-08-27","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-13235","description":"In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.","exploit_maturity":"Working exploit published","published":"2019-08-27","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-13234","description":"In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.","exploit_maturity":"Working exploit published","published":"2019-08-27","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-0193","description":"In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's \"dataConfig\" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property \"enable.dih.dataConfigParam\" to true.","exploit_maturity":"Exploited in the wild","published":"2019-08-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2019-2767","description":"Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2019-07-23","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2019-11269","description":"Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.","exploit_maturity":"Working exploit published","published":"2019-06-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-6588","description":"In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the \"url\" parameter of the JSP taglib call \u003cliferay-ui:captcha url=\"\u003c%= url %\u003e\" /\u003e or \u003cliferay-captcha:captcha url=\"\u003c%= url %\u003e\" /\u003e. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.","exploit_maturity":"Working exploit published","published":"2019-06-03","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-0221","description":"The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.","exploit_maturity":"Working exploit published","published":"2019-05-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-0186","description":"The input fields of the Apache Pluto \"Chat Room\" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file","exploit_maturity":"Working exploit published","published":"2019-04-26","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-2588","description":"Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2019-04-23","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-2579","description":"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2019-04-23","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-2578","description":"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2019-04-23","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2019-10247","description":"In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.","exploit_maturity":"No public exploit","published":"2019-04-22","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-10246","description":"In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.","exploit_maturity":"No public exploit","published":"2019-04-22","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-10241","description":"In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.","exploit_maturity":"No public exploit","published":"2019-04-22","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-1003030","description":"A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.","exploit_maturity":"Exploited in the wild","published":"2019-03-08","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-1003029","description":"A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.","exploit_maturity":"Exploited in the wild","published":"2019-03-08","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2019-3778","description":"Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the \"redirect_uri\" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).","exploit_maturity":"Working exploit published","published":"2019-03-07","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-6804","description":"An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/_wfitemEdit.gsp.","exploit_maturity":"Working exploit published","published":"2019-01-25","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2019-1003002","description":"A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.","exploit_maturity":"Working exploit published","published":"2019-01-22","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2019-1003001","description":"A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.","exploit_maturity":"Working exploit published","published":"2019-01-22","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2019-1003000","description":"A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.","exploit_maturity":"Working exploit published","published":"2019-01-22","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2019-2413","description":"Vulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). The supported version that is affected is 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Reports Developer, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Reports Developer accessible data as well as unauthorized read access to a subset of Oracle Reports Developer accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2019-01-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2018-15801","description":"Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issuer.","exploit_maturity":"No public exploit","published":"2018-12-19","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2018-14667","description":"The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.","exploit_maturity":"Exploited in the wild","published":"2018-11-06","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2017-18349","description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.","exploit_maturity":"Working exploit published","published":"2018-10-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2018-3238","description":"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 11.1.1.8.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2018-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2018-3167","description":"Vulnerability in the Application Management Pack for Oracle E-Business Suite component of Oracle E-Business Suite (subcomponent: User Monitoring). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Management Pack for Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Application Management Pack for Oracle E-Business Suite accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2018-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2018-3150","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Utility). The supported version that is affected is Java SE: 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","exploit_maturity":"No public exploit","published":"2018-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2018-3136","description":"Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g. code installed by an administrator). CVSS 3.0 Base Score 3.4 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N).","exploit_maturity":"No public exploit","published":"2018-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2018-8006","description":"An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.","exploit_maturity":"Working exploit published","published":"2018-10-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2018-1000632","description":"dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.","exploit_maturity":"No public exploit","published":"2018-08-20","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2018-14335","description":"An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.","exploit_maturity":"Working exploit published","published":"2018-07-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2018-1999002","description":"A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.","exploit_maturity":"Working exploit published","published":"2018-07-23","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2018-1306","description":"The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.","exploit_maturity":"Working exploit published","published":"2018-06-27","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2018-1000600","description":"A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.","exploit_maturity":"Working exploit published","published":"2018-06-26","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2018-6671","description":"Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.","exploit_maturity":"Working exploit published","published":"2018-06-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2018-1000180","description":"Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.","exploit_maturity":"No public exploit","published":"2018-06-05","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2018-1335","description":"From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.","exploit_maturity":"Working exploit published","published":"2018-04-25","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2018-2791","description":"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2018-04-19","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2018-1273","description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.","exploit_maturity":"Exploited in the wild","published":"2018-04-11","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2018-8718","description":"Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.","exploit_maturity":"Working exploit published","published":"2018-03-27","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2018-1322","description":"An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.","exploit_maturity":"Working exploit published","published":"2018-03-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2018-1321","description":"An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.","exploit_maturity":"Working exploit published","published":"2018-03-20","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2018-1199","description":"Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.","exploit_maturity":"No public exploit","published":"2018-03-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2018-1000130","description":"A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.","exploit_maturity":"Working exploit published","published":"2018-03-14","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2018-1000129","description":"An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.","exploit_maturity":"Working exploit published","published":"2018-03-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2017-12626","description":"Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).","exploit_maturity":"No public exploit","published":"2018-01-29","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2018-2636","description":"Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security). Supported versions that are affected are 2.7, 2.8 and 2.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Simphony. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2018-01-18","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2017-1000486","description":"Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution","exploit_maturity":"Exploited in the wild","published":"2018-01-03","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2013-4578","description":"jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.","exploit_maturity":"No public exploit","published":"2017-12-29","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2017-10366","description":"Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2017-10-19","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2017-10033","description":"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Support Tools). Supported versions that are affected are 11.1.1.8.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter Sites executes to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data as well as unauthorized read access to a subset of Oracle WebCenter Sites accessible data. Note: Please refer to Doc ID \u003ca href=\"http://support.oracle.com/CSP/main/article?cmd=show\u0026type=NOT\u0026id=2318213.1\"\u003eMy Oracle Support Note 2318213.1 for instructions on how to address this issue. CVSS 3.0 Base Score 4.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2017-10-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2017-10246","description":"Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data as well as unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2017-08-08","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2017-10198","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).","exploit_maturity":"No public exploit","published":"2017-08-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2017-10102","description":"Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2017-08-08","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2017-10075","description":"Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Supported versions that are affected are 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2017-08-08","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2017-10046","description":"Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2 and 16.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2017-08-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2017-11467","description":"OrientDB through 2.2.22 does not enforce privilege requirements during \"where\" or \"fetchplan\" or \"order by\" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.","exploit_maturity":"Working exploit published","published":"2017-07-20","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2016-4977","description":"When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.","exploit_maturity":"Working exploit published","published":"2017-05-25","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2015-5211","description":"Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.","exploit_maturity":"No public exploit","published":"2017-05-25","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2017-7957","description":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"\u003cvoid/\u003e\") call.","exploit_maturity":"No public exploit","published":"2017-04-29","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2017-3528","description":"Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2017-04-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2016-4316","description":"Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-list/webapp_info.jsp; the (4) dsName or (5) description parameter to ndatasource/newdatasource.jsp; the (6) phase parameter to viewflows/handlers.jsp; or the (7) url parameter to ndatasource/validateconnection-ajaxprocessor.jsp.","exploit_maturity":"Working exploit published","published":"2017-02-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2016-9299","description":"The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.","exploit_maturity":"Working exploit published","published":"2017-01-12","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2016-3473","description":"Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality via unknown vectors.","exploit_maturity":"Working exploit published","published":"2016-10-25","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2016-5425","description":"The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.","exploit_maturity":"Working exploit published","published":"2016-10-13","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2015-2080","description":"The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.","exploit_maturity":"Working exploit published","published":"2016-10-07","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2016-1240","description":"The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.","exploit_maturity":"Working exploit published","published":"2016-10-03","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2016-3542","description":"Unspecified vulnerability in the Oracle Knowledge Management component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote administrators to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"Working exploit published","published":"2016-07-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2016-3092","description":"The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.","exploit_maturity":"No public exploit","published":"2016-07-04","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2016-3670","description":"Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.","exploit_maturity":"Working exploit published","published":"2016-06-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2016-4437","description":"Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.","exploit_maturity":"Exploited in the wild","published":"2016-06-07","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2016-3087","description":"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.","exploit_maturity":"Working exploit published","published":"2016-06-07","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2016-3088","description":"The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","exploit_maturity":"Exploited in the wild","published":"2016-06-01","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2016-3427","description":"Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.","exploit_maturity":"Exploited in the wild","published":"2016-04-21","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2016-0695","description":"Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security.","exploit_maturity":"No public exploit","published":"2016-04-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2016-0793","description":"Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) \"meaningless\" characters.","exploit_maturity":"Working exploit published","published":"2016-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2016-0956","description":"The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.","exploit_maturity":"Working exploit published","published":"2016-02-10","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2016-0491","description":"Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.","exploit_maturity":"Working exploit published","published":"2016-01-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2016-0466","description":"Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAXP.","exploit_maturity":"No public exploit","published":"2016-01-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2015-5317","description":"The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.","exploit_maturity":"Exploited in the wild","published":"2015-11-25","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.","exploit_maturity":"No public exploit","published":"2015-10-27","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2015-4878","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4877.","exploit_maturity":"Working exploit published","published":"2015-10-21","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2015-4877","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4878.","exploit_maturity":"Working exploit published","published":"2015-10-21","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2015-3158","description":"The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.","exploit_maturity":"No public exploit","published":"2015-08-26","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2015-0277","description":"The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.","exploit_maturity":"No public exploit","published":"2015-08-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2014-3576","description":"The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.","exploit_maturity":"No public exploit","published":"2015-08-14","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2015-4749","description":"Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI.","exploit_maturity":"No public exploit","published":"2015-07-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2015-2572","description":"Unspecified vulnerability in the Oracle Hyperion Smart View for Office component in Oracle Hyperion 11.1.2.5.216 and earlier, when running on Windows, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.","exploit_maturity":"Working exploit published","published":"2015-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2015-0493","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.1, 8.5.0, and 8.5.1 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-0474.","exploit_maturity":"Working exploit published","published":"2015-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2015-0488","description":"Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect availability via vectors related to JSSE.","exploit_maturity":"No public exploit","published":"2015-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2015-0478","description":"Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect confidentiality via vectors related to JCE.","exploit_maturity":"No public exploit","published":"2015-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2015-0474","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.1, 8.5.0, and 8.5.1 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-0493.","exploit_maturity":"Working exploit published","published":"2015-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2015-1427","description":"The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.","exploit_maturity":"Exploited in the wild","published":"2015-02-17","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2015-0227","description":"Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to \"wrapping attacks.\"","exploit_maturity":"No public exploit","published":"2015-02-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2014-6558","description":"Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security.","exploit_maturity":"No public exploit","published":"2014-10-15","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2014-6512","description":"Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries.","exploit_maturity":"No public exploit","published":"2014-10-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2014-6468","description":"Unspecified vulnerability in Oracle Java SE 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.","exploit_maturity":"No public exploit","published":"2014-10-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2014-3120","description":"The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.","exploit_maturity":"Exploited in the wild","published":"2014-07-28","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2014-4263","description":"Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to \"Diffie-Hellman key agreement.\"","exploit_maturity":"No public exploit","published":"2014-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2014-4244","description":"Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.","exploit_maturity":"No public exploit","published":"2014-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2014-4210","description":"Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services.","exploit_maturity":"Working exploit published","published":"2014-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2014-0113","description":"CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.","exploit_maturity":"Working exploit published","published":"2014-04-29","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2014-2424","description":"Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system.","exploit_maturity":"Working exploit published","published":"2014-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2014-2399","description":"Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attackers to affect integrity via unknown vectors related to Oracle Endeca Information Discovery (Formerly Latitude), a different vulnerability than CVE-2014-2400.","exploit_maturity":"Working exploit published","published":"2014-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2014-0050","description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","exploit_maturity":"Working exploit published","published":"2014-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2014-0094","description":"The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to \"manipulate\" the ClassLoader via the class parameter, which is passed to the getClass method.","exploit_maturity":"Working exploit published","published":"2014-03-11","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2014-1202","description":"The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.","exploit_maturity":"Working exploit published","published":"2014-01-25","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2014-0379","description":"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote attackers to affect integrity via unknown vectors related to DM Others.","exploit_maturity":"Working exploit published","published":"2014-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2014-0372","description":"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.1, and 12.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to DM Others.","exploit_maturity":"Working exploit published","published":"2014-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-5880","description":"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 12.2.0, 12.2.1, and 12.2.2 allows remote attackers to affect confidentiality via unknown vectors related to DM Others.","exploit_maturity":"Working exploit published","published":"2014-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-5877","description":"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.0, and 12.2.1 allows remote attackers to affect confidentiality via unknown vectors related to DM Others.","exploit_maturity":"Working exploit published","published":"2014-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-5795","description":"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.1, 12.2.2, and 12.2.3 allows remote attackers to affect confidentiality via unknown vectors related to DM Others.","exploit_maturity":"Working exploit published","published":"2014-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-5573","description":"Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.","exploit_maturity":"Working exploit published","published":"2013-12-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-5676","description":"The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.","exploit_maturity":"Working exploit published","published":"2013-12-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-6357","description":"Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI. NOTE: the vendor disputes the significance of this report, stating that \"the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.","exploit_maturity":"Working exploit published","published":"2013-11-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-5825","description":"Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via vectors related to JAXP.","exploit_maturity":"No public exploit","published":"2013-10-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-5791","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 and 8.4.1 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters. NOTE: the previous information is from the October 2013 CPU. Oracle has not commented on claims from a third party that the issue is a stack-based buffer overflow in the Microsoft Access 1.x parser in vsacs.dll before 8.4.0.108 and before 8.4.1.52, which allows attackers to execute arbitrary code via a long field (aka column) name.","exploit_maturity":"Working exploit published","published":"2013-10-16","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2013-2160","description":"The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.","exploit_maturity":"Working exploit published","published":"2013-08-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-4883","description":"Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent (MA) 4.5 through 4.6, allow remote attackers to inject arbitrary web script or HTML via the (1) instanceId parameter core/loadDisplayType.do; (2) instanceId or (3) monitorUrl parameter to console/createDashboardContainer.do; uid parameter to (4) ComputerMgmt/sysDetPanelBoolPie.do or (5) ComputerMgmt/sysDetPanelSummary.do; (6) uid, (7) orion.user.security.token, or (8) ajaxMode parameter to ComputerMgmt/sysDetPanelQry.do; or (9) uid, (10) orion.user.security.token, or (11) ajaxMode parameter to ComputerMgmt/sysDetPanelSummary.do.","exploit_maturity":"Working exploit published","published":"2013-07-22","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-2248","description":"Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.","exploit_maturity":"Working exploit published","published":"2013-07-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-3803","description":"Unspecified vulnerability in the Hyperion BI+ component in Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier, 11.1.2.1.129 and earlier, and 11.1.2.2.305 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Intelligence Service.","exploit_maturity":"Working exploit published","published":"2013-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2013-3763","description":"Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2013-3764.","exploit_maturity":"Working exploit published","published":"2013-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-2134","description":"Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.","exploit_maturity":"Working exploit published","published":"2013-07-16","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2013-1768","description":"The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.","exploit_maturity":"No public exploit","published":"2013-07-11","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2013-2115","description":"Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.","exploit_maturity":"Working exploit published","published":"2013-07-10","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2013-1966","description":"Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.","exploit_maturity":"Working exploit published","published":"2013-07-10","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2013-1965","description":"Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.","exploit_maturity":"Working exploit published","published":"2013-07-10","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2013-2465","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to \"Incorrect image channel verification\" in 2D.","exploit_maturity":"Exploited in the wild","published":"2013-06-18","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2013-2451","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Networking. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper enforcement of exclusive port binds when running on Windows, which allows attackers to bind to ports that are already in use.","exploit_maturity":"No public exploit","published":"2013-06-18","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2013-2423","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.","exploit_maturity":"Exploited in the wild","published":"2013-04-17","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2013-2415","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows local users to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to \"processing of MTOM attachments\" and the creation of temporary files with weak permissions.","exploit_maturity":"No public exploit","published":"2013-04-17","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2013-1559","description":"Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect availability via unknown vectors related to Content Server.","exploit_maturity":"Working exploit published","published":"2013-04-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-1509","description":"Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 7.6.2, 11.1.1.6.0, and 11.1.1.6.1 allows remote authenticated users to affect integrity via unknown vectors related to WebCenter Sites.","exploit_maturity":"Working exploit published","published":"2013-04-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-1814","description":"The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.","exploit_maturity":"Working exploit published","published":"2013-03-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-0431","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka \"Issue 52,\" a different vulnerability than CVE-2013-1490.","exploit_maturity":"Exploited in the wild","published":"2013-01-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2013-0397","description":"Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Diagnostics.","exploit_maturity":"Working exploit published","published":"2013-01-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2011-2732","description":"CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.","exploit_maturity":"Working exploit published","published":"2012-12-05","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2012-3186","description":"Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Advanced UI, a different vulnerability than CVE-2012-3183 and CVE-2012-3185.","exploit_maturity":"Working exploit published","published":"2012-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2012-3185","description":"Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Advanced UI, a different vulnerability than CVE-2012-3183 and CVE-2012-3186.","exploit_maturity":"Working exploit published","published":"2012-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2012-3184","description":"Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote attackers to affect integrity via unknown vectors related to Advanced UI.","exploit_maturity":"Working exploit published","published":"2012-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2012-3183","description":"Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Advanced UI, a different vulnerability than CVE-2012-3185 and CVE-2012-3186.","exploit_maturity":"Working exploit published","published":"2012-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2012-5076","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.","exploit_maturity":"Exploited in the wild","published":"2012-10-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2011-5167","description":"Heap-based buffer overflow in the SetDevNames method of the Tidestone Formula One ActiveX control (TTF16.ocx) 6.3.5 Build 1 in Oracle Hyperion Strategic Finance 12.x and possibly earlier allows remote attackers to execute arbitrary code via a long string to the DriverName parameter.","exploit_maturity":"Working exploit published","published":"2012-09-15","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2012-0547","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier, and 6 Update 34 and earlier, has no impact and remote attack vectors involving AWT and \"a security-in-depth issue that is not directly exploitable but which can be used to aggravate security vulnerabilities that can be directly exploited.\" NOTE: this identifier was assigned by the Oracle CNA, but CVE is not intended to cover defense-in-depth issues that are only exposed by the presence of other vulnerabilities. NOTE: Oracle has not commented on claims from a downstream vendor that this issue is related to \"toolkit internals references.\"","exploit_maturity":"Working exploit published","published":"2012-08-30","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2012-4681","description":"Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using \"reflection with a trusted immediate caller\" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.","exploit_maturity":"Exploited in the wild","published":"2012-08-28","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2012-1770","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-1766, CVE-2012-1767, CVE-2012-1769, CVE-2012-1771, CVE-2012-1772, CVE-2012-1773, CVE-2012-3106, CVE-2012-3107, CVE-2012-3108, and CVE-2012-3110.","exploit_maturity":"Working exploit published","published":"2012-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2012-1769","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-1766, CVE-2012-1767, CVE-2012-1770, CVE-2012-1771, CVE-2012-1772, CVE-2012-1773, CVE-2012-3106, CVE-2012-3107, CVE-2012-3108, and CVE-2012-3110.","exploit_maturity":"Working exploit published","published":"2012-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2012-1744","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent users to affect availability via unknown vectors related to Outside In Filters.","exploit_maturity":"Working exploit published","published":"2012-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2012-2138","description":"The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.","exploit_maturity":"Working exploit published","published":"2012-07-09","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2012-1724","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect availability, related to JAXP.","exploit_maturity":"No public exploit","published":"2012-06-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2012-1723","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.","exploit_maturity":"Exploited in the wild","published":"2012-06-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2012-0507","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.","exploit_maturity":"Exploited in the wild","published":"2012-06-07","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2012-0549","description":"Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confidentiality, integrity, and availability, related to Desktop API.","exploit_maturity":"Working exploit published","published":"2012-05-03","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2012-1007","description":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.","exploit_maturity":"Working exploit published","published":"2012-02-07","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2012-1006","description":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.","exploit_maturity":"Working exploit published","published":"2012-02-07","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2012-0393","description":"The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.","exploit_maturity":"Working exploit published","published":"2012-01-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2012-0392","description":"The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.","exploit_maturity":"Working exploit published","published":"2012-01-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2012-0391","description":"The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.","exploit_maturity":"Exploited in the wild","published":"2012-01-08","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2011-5057","description":"Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an \"easy work-around in existing apps by configuring the interceptor.\"","exploit_maturity":"Working exploit published","published":"2012-01-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2011-4858","description":"Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","exploit_maturity":"Working exploit published","published":"2012-01-05","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2011-5034","description":"Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.","exploit_maturity":"Working exploit published","published":"2011-12-30","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2011-3544","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.","exploit_maturity":"Exploited in the wild","published":"2011-10-19","resolved":"MITIGATION-CANDIDATE","severity":"Critical"}, {"cve_id":"CVE-2011-2894","description":"Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.","exploit_maturity":"Proof of concept only","published":"2011-10-04","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-3271","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.","exploit_maturity":"Working exploit published","published":"2011-07-18","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2011-1772","description":"Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.","exploit_maturity":"Working exploit published","published":"2011-05-13","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2011-0836","description":"Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Tools 8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 allows remote authenticated users to affect integrity, related to Web Runtime SEC.","exploit_maturity":"Working exploit published","published":"2011-04-20","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2011-0807","description":"Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration.","exploit_maturity":"Working exploit published","published":"2011-04-20","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2010-4476","description":"The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.","exploit_maturity":"Working exploit published","published":"2011-02-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-4437","description":"Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 9.0, 9.1, 9.2.4, 10.0.2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet Container.","exploit_maturity":"Working exploit published","published":"2011-01-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-4417","description":"Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, and 2.0.1.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that voice-servlet/prompt-qa/Index.jspf does not properly handle null (%00) bytes in the evaluation parameter that is used in a filename, which allows attackers to create a file with an executable extension and execute arbitrary JSP code.","exploit_maturity":"Working exploit published","published":"2011-01-19","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2010-3595","description":"Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect confidentiality via unknown vectors related to Import Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from the original researcher that remote attackers can read arbitrary files via a full pathname in the first argument to the ImportBodyText method in the EasyMail ActiveX control (emsmtp.dll).","exploit_maturity":"Working exploit published","published":"2011-01-19","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2010-4172","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.","exploit_maturity":"Working exploit published","published":"2010-11-26","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-3581","description":"Unspecified vulnerability in the BPEL Console component in Oracle Fusion Middleware 11.1.1.1.0 and 11.1.1.2.0 allows remote authenticated users to affect integrity via unknown vectors.","exploit_maturity":"Working exploit published","published":"2010-10-14","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2010-1870","description":"The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the \"#\" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.","exploit_maturity":"Working exploit published","published":"2010-08-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-1871","description":"JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.","exploit_maturity":"Exploited in the wild","published":"2010-08-05","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2010-2375","description":"Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.","exploit_maturity":"Working exploit published","published":"2010-07-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-2370","description":"Unspecified vulnerability in the Oracle Business Process Management component in Oracle Fusion Middleware 5.7 MP3, 6.0 MP5, and 10.3 MP2 allows remote attackers to affect integrity, related to BPM.","exploit_maturity":"Working exploit published","published":"2010-07-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-2103","description":"Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.","exploit_maturity":"Working exploit published","published":"2010-05-27","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-1587","description":"The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.","exploit_maturity":"Working exploit published","published":"2010-04-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-0738","description":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.","exploit_maturity":"Exploited in the wild","published":"2010-04-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2010-1157","description":"Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.","exploit_maturity":"Working exploit published","published":"2010-04-23","resolved":"MITIGATION-CANDIDATE","severity":"Low"}, {"cve_id":"CVE-2010-0886","description":"Unspecified vulnerability in the Java Deployment Toolkit component in Oracle Java SE and Java for Business JDK and JRE 6 Update 10 through 19 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"Working exploit published","published":"2010-04-20","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2010-0842","description":"Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an uncontrolled array index that allows remote attackers to execute arbitrary code via a MIDI file with a crafted MixerSequencer object, related to the GM_Song structure.","exploit_maturity":"Working exploit published","published":"2010-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2010-0838","description":"Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow using an untrusted size value in the readMabCurveData function in the CMM module in the JVM.","exploit_maturity":"Working exploit published","published":"2010-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2009-3548","description":"The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.","exploit_maturity":"Working exploit published","published":"2009-11-12","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2009-0580","description":"Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.","exploit_maturity":"Working exploit published","published":"2009-06-05","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2009-1595","description":"The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.","exploit_maturity":"Working exploit published","published":"2009-05-11","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2009-0039","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.","exploit_maturity":"Working exploit published","published":"2009-04-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2009-0038","description":"Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.","exploit_maturity":"Working exploit published","published":"2009-04-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2008-6504","description":"ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \\u0023 representation for the # character.","exploit_maturity":"Working exploit published","published":"2009-03-23","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2009-0855","description":"Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","exploit_maturity":"Working exploit published","published":"2009-03-09","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2009-0026","description":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.","exploit_maturity":"Working exploit published","published":"2009-01-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2008-5266","description":"Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via the name parameter, a different vector than CVE-2008-2751.","exploit_maturity":"Working exploit published","published":"2008-11-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2008-1232","description":"Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.","exploit_maturity":"Working exploit published","published":"2008-08-04","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2008-2751","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.1_01 allow remote attackers to inject arbitrary web script or HTML via the (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (2) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (3) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, or (4) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (a) resourceNode/customResourceNew.jsf; the (5) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (6) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (7) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, (8) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup, or (9) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (b) resourceNode/externalResourceNew.jsf; the (10) propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi, (11) propertyForm:propertySheet:propertSectionTextField:nameProp:name, or (12) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (c) resourceNode/jmsDestinationNew.jsf; the (13) propertyForm:propertySheet:generalPropertySheet:jndiProp:Jndi or (14) propertyForm:propertySheet:generalPropertySheet:descProp:cd parameter to (d) resourceNode/jmsConnectionNew.jsf; the (15) propertyForm:propertySheet:propertSectionTextField:jndiProp:jnditext or (16) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (e) resourceNode/jdbcResourceNew.jsf; the (17) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:nameProp:name, (18) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:classNameProp:classname, or (19) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:loadOrderProp:loadOrder parameter to (f) applications/lifecycleModulesNew.jsf; or the (20) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:jndiProp:name, (21) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:resTypeProp:resType, or (22) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:dbProp:db parameter to (g) resourceNode/jdbcConnectionPoolNew1.jsf.","exploit_maturity":"Working exploit published","published":"2008-06-18","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2008-1510","description":"Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users_list.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the (1) searchfilter or (2) listSearchFilter parameter.","exploit_maturity":"Working exploit published","published":"2008-03-25","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2008-1357","description":"Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8.","exploit_maturity":"Working exploit published","published":"2008-03-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2008-1300","description":"Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter in a save action, a different vector than CVE-2008-1045.","exploit_maturity":"Working exploit published","published":"2008-03-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2008-1193","description":"Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to gain privileges via an untrusted application.","exploit_maturity":"Working exploit published","published":"2008-03-06","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2008-1045","description":"Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree_files.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the resource parameter.","exploit_maturity":"Working exploit published","published":"2008-02-27","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2007-5333","description":"Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (\") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.","exploit_maturity":"Working exploit published","published":"2008-02-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2007-5944","description":"Cross-site scripting (XSS) vulnerability in Servlet Engine / Web Container in IBM WebSphere Application Server (WAS) 5.1.1.4 through 5.1.1.16 allows remote attackers to inject arbitrary web script or HTML via the Expect HTTP header. NOTE: this might be the same issue as CVE-2006-3918, but there are insufficient details to be sure.","exploit_maturity":"Working exploit published","published":"2007-11-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2007-5019","description":"Buffer overflow in the Sun Java Web Start ActiveX control in Java Runtime Environment (JRE) 1.6.0_X allows remote attackers to have an unknown impact via a long argument to the dnsResolve (isInstalled.dnsResolve) method.","exploit_maturity":"Working exploit published","published":"2007-09-20","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2007-4556","description":"Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a \"%{\" sequence and ending with a \"}\" character.","exploit_maturity":"Working exploit published","published":"2007-08-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2007-4381","description":"Unspecified vulnerability in the font parsing implementation in Sun JDK and JRE 5.0 Update 9 and earlier, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to perform unauthorized actions via an applet that grants certain privileges to itself.","exploit_maturity":"Working exploit published","published":"2007-08-17","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2007-3386","description":"Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.","exploit_maturity":"Working exploit published","published":"2007-08-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2007-3382","description":"Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (\"'\") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.","exploit_maturity":"Working exploit published","published":"2007-08-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2007-3655","description":"Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file.","exploit_maturity":"Working exploit published","published":"2007-07-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2007-2449","description":"Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a \"snp/snoop.jsp;\" sequence.","exploit_maturity":"Working exploit published","published":"2007-06-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2007-1355","description":"Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.","exploit_maturity":"Working exploit published","published":"2007-05-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2006-7196","description":"Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.","exploit_maturity":"Working exploit published","published":"2007-05-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2007-2353","description":"Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.","exploit_maturity":"Working exploit published","published":"2007-04-30","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2007-0297","description":"Unspecified vulnerability in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.47.11 and 8.48.06 has unknown impact and attack vectors in PeopleTools, aka PSE03.","exploit_maturity":"Working exploit published","published":"2007-01-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2006-3835","description":"Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.","exploit_maturity":"Working exploit published","published":"2006-07-25","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2006-2431","description":"Cross-site scripting (XSS) vulnerability in the 500 Internal Server Error page on the SOAP port (8880/tcp) in IBM WebSphere Application Server 5.0.2 and earlier, 5.1.x before 5.1.1.12, and 6.0.2 up to 6.0.2.7, allows remote attackers to inject arbitrary web script or HTML via the URI, which is contained in a FAULTACTOR element on this page. NOTE: some sources have reported the element as \"faultfactor,\" but this is likely erroneous.","exploit_maturity":"Working exploit published","published":"2006-05-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2006-2426","description":"Sun Java Runtime Environment (JRE) 1.5.0_6 and earlier, JDK 1.5.0_6 and earlier, and SDK 1.5.0_6 and earlier allows remote attackers to cause a denial of service (disk consumption) by using the Font.createFont function to create temporary files of arbitrary size in the %temp% directory.","exploit_maturity":"Working exploit published","published":"2006-05-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2006-0254","description":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.","exploit_maturity":"Working exploit published","published":"2006-01-18","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2005-4703","description":"Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.","exploit_maturity":"Working exploit published","published":"2005-12-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2005-3747","description":"Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash (\"%5C\") characters. NOTE: this might be the same issue as CVE-2006-2758.","exploit_maturity":"Working exploit published","published":"2005-11-22","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2005-1112","description":"IBM WebSphere Application Server 6.0 and earlier, when sharing the document root of the web server, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via an HTTP request with an invalid Host header, which causes the page to be processed by the web server instead of the JSP engine.","exploit_maturity":"Working exploit published","published":"2005-05-02","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2004-2115","description":"Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.","exploit_maturity":"Working exploit published","published":"2004-12-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2004-0095","description":"McAfee ePolicy Orchestrator agent allows remote attackers to cause a denial of service (memory consumption and crash) and possibly execute arbitrary code via an HTTP POST request with an invalid Content-Length value, possibly triggering a buffer overflow.","exploit_maturity":"Working exploit published","published":"2004-02-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2003-1123","description":"Sun Java Runtime Environment (JRE) and SDK 1.4.0_01 and earlier allows untrusted applets to access certain information within trusted applets, which allows attackers to bypass the restrictions of the Java security model.","exploit_maturity":"Working exploit published","published":"2003-12-31","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2003-0896","description":"The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains \"/\" (slash) instead of \".\" (dot) characters, which bypasses a call to the Security Manager's checkPackageAccess method.","exploit_maturity":"Working exploit published","published":"2003-11-17","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2003-0866","description":"The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.","exploit_maturity":"Working exploit published","published":"2003-11-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2002-1567","description":"Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.","exploit_maturity":"Working exploit published","published":"2003-10-06","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2002-1533","description":"Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters (%0a).","exploit_maturity":"Working exploit published","published":"2003-03-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2002-2272","description":"Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.","exploit_maturity":"Working exploit published","published":"2002-12-31","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2002-2072","description":"java.security.AccessController in Sun Java Virtual Machine (JVM) in JRE 1.2.2 and 1.3.1 allows remote attackers to cause a denial of service (JVM crash) via a Java program that calls the doPrivileged method with a null argument.","exploit_maturity":"Working exploit published","published":"2002-12-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2002-2007","description":"The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.","exploit_maturity":"Working exploit published","published":"2002-12-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2002-2006","description":"The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.","exploit_maturity":"Working exploit published","published":"2002-12-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2002-1148","description":"The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.","exploit_maturity":"Working exploit published","published":"2002-10-11","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2002-0936","description":"The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).","exploit_maturity":"Working exploit published","published":"2002-10-04","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2002-0682","description":"Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.","exploit_maturity":"Working exploit published","published":"2002-07-23","resolved":"MITIGATION-CANDIDATE","severity":"High"}, {"cve_id":"CVE-2001-0590","description":"Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).","exploit_maturity":"Working exploit published","published":"2001-08-02","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2001-0390","description":"IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to cause a denial of service by directly calling the macro.d2w macro with a long string of %0a characters.","exploit_maturity":"Working exploit published","published":"2001-07-02","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2000-0760","description":"The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.","exploit_maturity":"Working exploit published","published":"2000-10-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2000-0759","description":"Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.","exploit_maturity":"Working exploit published","published":"2000-10-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}, {"cve_id":"CVE-2000-0652","description":"IBM WebSphere allows remote attackers to read source code for executable web files by directly calling the default InvokerServlet using a URL which contains the \"/servlet/file\" string.","exploit_maturity":"Working exploit published","published":"2000-07-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"} ]