TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-qpwj-mvv7-v3m9
Summary: High severity vulnerability that affects org.apache.cxf.fediz:fediz-spring and org.apache.cxf.fediz:fediz-spring2
Aliases: CVE-2016-4464
Severity: HIGH
CWE: CWE-284
Published: 2018-10-18T16:57:10Z

The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.
Vulnerability: GHSA-jh5g-9m4v-9vv9
Summary: Insecure Java Deserialization in Apache Karaf
Aliases: CVE-2021-41766
Severity: HIGH
CWE: CWE-502
Published: 2022-01-28T22:24:48Z

Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder).
Vulnerability: GHSA-q35p-chc6-7x57
Summary: Moderate severity vulnerability that affects org.apache.storm:storm-core
Aliases: CVE-2018-1332
Severity: MODERATE
CWE: CWE-200
Published: 2018-10-17T19:48:18Z

Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another user when communicating with some Storm Daemons.
Vulnerability: GHSA-hwcx-9p4j-7hwj
Summary: XML Entity Expansion in Pippo
Aliases: CVE-2019-5442
Severity: HIGH
CWE: CWE-776
Published: 2019-06-13T20:22:30Z

XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.
Vulnerability: GHSA-xhcq-fv7x-grr2
Summary: Critical severity vulnerability that affects org.apache.solr:solr-core
Aliases: CVE-2019-0192
Severity: CRITICAL
CWE: CWE-502
Published: 2019-03-14T15:39:45Z

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.
Vulnerability: GHSA-v2r2-7qm7-jj6v
Summary: Moderate severity vulnerability that affects org.springframework.security:spring-security-core
Aliases: CVE-2019-3795
Severity: MODERATE
CWE: CWE-330, CWE-332
Published: 2019-04-16T15:10:59Z

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.
Vulnerability: GHSA-w69w-jvc7-wjgv
Summary: Missing Authorization in undertow
Aliases: CVE-2019-10184
Severity: HIGH
CWE: CWE-862
Published: 2019-08-01T19:18:16Z

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
Vulnerability: GHSA-65hp-4vxr-c356
Summary: Arbitrary code execution in Magnolia CMS
Aliases: CVE-2021-46363
Severity: HIGH
Published: 2022-02-12T00:00:37Z

An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted CSV/XLS file.
Vulnerability: GHSA-4r64-wf76-c53p
Summary: In blynk-server a Directory Traversal exists
Aliases: CVE-2018-17785
Severity: HIGH
CWE: CWE-22
Published: 2018-10-17T19:52:52Z

In blynk-server in Blynk before 0.39.7, Directory Traversal exists via a ../ in a URI that has /static or /static/js at the beginning, as demonstrated by reading the /etc/passwd file.
Vulnerability: GHSA-mr8h-j9cv-4m8h
Summary: Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
Aliases: CVE-2021-31408
Severity: MODERATE
CWE: CWE-287, CWE-613
Published: 2021-04-22T16:11:17Z

`Authentication.logout()` helper in `com.vaadin:flow-client` versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

- https://vaadin.com/security/cve-2021-31408
Vulnerability: GHSA-mm7m-xg4h-6m52
Summary: Allocation of Resources Without Limits or Throttling in Apache Tika
Aliases: CVE-2019-10094
Severity: HIGH
CWE: CWE-770
Published: 2019-08-06T01:43:35Z

A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.
Vulnerability: GHSA-99px-7724-484v
Summary: Remote Code Execution in Any23
Aliases: CVE-2021-40146
Severity: CRITICAL
Published: 2021-09-13T20:06:38Z

A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class of arbitrary code execution (ACE) vulnerabilities.
Vulnerability: GHSA-878w-7gxp-mc63
Summary: SQL Injection in Spring Cloud Task
Aliases: CVE-2020-5428
Severity: MODERATE
CWE: CWE-89
Published: 2022-02-09T22:16:53Z

In applications using Spring Cloud Task 2.2.4.RELEASE and below, may be vulnerable to SQL injection when exercising certain lookup queries in the TaskExplorer.
Vulnerability: GHSA-36qh-35cm-5w2w
Summary: Authentication Bypass by Alternate Name in Apache Tomcat
Aliases: CVE-2021-30640
Severity: MODERATE
CWE: CWE-289, CWE-287
Published: 2021-08-13T15:21:24Z

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.
Vulnerability: GHSA-m4hg-5p2m-fm5m
Summary: Arbitrary code execution in Magnolia CMS
Aliases: CVE-2021-46361
Severity: CRITICAL
Published: 2022-02-12T00:00:37Z

An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.
Vulnerability: GHSA-hgpg-593r-hhvp
Summary: Cross-site Scripting in Keycloak
Aliases: CVE-2020-10748
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-09T00:56:37Z

A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks.
Vulnerability: GHSA-h3wv-47xm-4mg6
Summary: Moderate severity vulnerability that affects com.kitfox.svg:svg-salamander
Aliases: CVE-2017-5617
Severity: HIGH
CWE: CWE-918
Published: 2018-10-19T16:51:25Z

The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks via an xlink:href attribute in an SVG file.
Vulnerability: GHSA-62hc-f8qj-5xc3
Summary: Path traversal in Phoenix AutoTest Plugin
Aliases: CVE-2022-28157
Severity: MODERATE
CWE: CWE-22
Published: 2022-03-30T00:00:22Z

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server.
Vulnerability: GHSA-36hf-6hp2-9g4c
Summary: Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms
Aliases: CVE-2019-13237
Severity: MODERATE
CWE: CWE-200, CWE-22
Published: 2019-11-12T22:58:14Z

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.
Vulnerability: GHSA-3gg7-9q2x-79fc
Summary: Improper Restriction of Rendered UI Layers or Frames in Keycloak
Aliases: CVE-2020-1728
Severity: MODERATE
CWE: CWE-1021
Published: 2020-04-15T21:09:40Z

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors.
Vulnerability: GHSA-2h3j-m7gr-25xj
Summary: Excessive Iteration Denial of Service in Apache PDFBox
Aliases: CVE-2021-27807
Severity: MODERATE
CWE: CWE-834
Published: 2021-06-16T17:56:46Z

A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Vulnerability: GHSA-j346-h5wc-rw2m
Summary: Incorrect Authorization in Apache Solr
Aliases: CVE-2018-11802
Severity: MODERATE
CWE: CWE-863
Published: 2022-02-09T23:19:26Z

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
Vulnerability: GHSA-hr32-mgpm-qf2f
Summary: Generation of Error Message Containing Sensitive Information in RESTEasy client
Aliases: CVE-2020-25633
Severity: MODERATE
CWE: CWE-209
Published: 2021-06-03T23:41:34Z

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.
Vulnerability: GHSA-wg5w-vv93-3f7w
Summary: Moderate severity vulnerability that affects org.apache.oozie:oozie-core
Aliases: CVE-2018-11799
Severity: MODERATE
CWE: CWE-20
Published: 2018-12-20T22:01:18Z

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results workflows running in other user's name.
Vulnerability: GHSA-h592-38cm-4ggp
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2017-15095
Severity: CRITICAL
CWE: CWE-502, CWE-184
Published: 2018-10-18T17:42:34Z

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
Vulnerability: GHSA-3v44-382q-55f4
Summary: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2017-15713
Severity: MODERATE
CWE: CWE-200
Published: 2018-12-21T17:50:13Z

Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.
Vulnerability: GHSA-mh83-jcw5-rjh8
Summary: XML External Entity Reference in edu.stanford.nlp:stanford-corenlp
Aliases: CVE-2022-0198
Severity: MODERATE
CWE: CWE-611
Published: 2022-01-14T21:07:23Z

The TransformXML() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.
Vulnerability: GHSA-9953-fmrw-v4vm
Summary: Cross-site Scripting in Apache JSPWiki
Aliases: CVE-2022-24948
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-26T00:00:44Z

A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later.
Vulnerability: GHSA-66gw-ch5v-74v8
Summary: Cross-site scripting (XSS) in Apache ActiveMQ
Aliases: CVE-2020-13947
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-09T22:01:32Z

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
Vulnerability: GHSA-2457-2263-mm9f
Summary: Memory leak in micronaut-core
Aliases: CVE-2022-21700
Severity: MODERATE
CWE: CWE-400
Published: 2022-01-21T23:19:36Z

### Impact

Sending an invalid Content Type header leads to memory leak in `DefaultArgumentConversionContext` as this type is erroneously used in static state.

### Patches

The problem is patched in Micronaut 3.2.7 and above.

### Workarounds

The default content type binder can be replaced in an existing Micronaut application to mitigate the issue:

```java
package example;

import java.util.List;
import io.micronaut.context.annotation.Replaces;
import io.micronaut.core.convert.ConversionService;
import io.micronaut.http.MediaType;
import io.micronaut.http.bind.DefaultRequestBinderRegistry;
import io.micronaut.http.bind.binders.RequestArgumentBinder;
import jakarta.inject.Singleton;

@Singleton
@Replaces(DefaultRequestBinderRegistry.class)
class FixedRequestBinderRegistry extends DefaultRequestBinderRegistry {

    public FixedRequestBinderRegistry(ConversionService conversionService,
                                      List<RequestArgumentBinder> binders) {
        super(conversionService, binders);
    }

    @Override
    protected void registerDefaultConverters(ConversionService<?> conversionService) {
        super.registerDefaultConverters(conversionService);
        conversionService.addConverter(CharSequence.class, MediaType.class, charSequence -> {
            try {
                return MediaType.of(charSequence);
            } catch (IllegalArgumentException e) {
                return null;
            }
        });
    }
}
```

### References

Commit that introduced the vulnerability https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Micronaut Core](https://github.com/micronaut-projects/micronaut-core/issues)
* Email us at [info@micronaut.io](mailto:info@micronaut.io)
Vulnerability: GHSA-2mq8-99q7-55wx
Summary: Code injection in keycloak
Aliases: CVE-2021-20222
Severity: HIGH
CWE: CWE-20
Published: 2021-05-13T22:29:51Z

A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GHSA-m4h3-7mc2-v295
Summary: An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.
Aliases: CVE-2020-35214
Severity: HIGH
Published: 2021-12-17T20:41:21Z

An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.
Vulnerability: GHSA-387v-84cv-9qmc
Summary: Moderate severity vulnerability that affects org.apache.solr:solr-core
Aliases: CVE-2017-3163
Severity: HIGH
CWE: CWE-22
Published: 2018-10-18T16:40:43Z

When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.
Vulnerability: GHSA-c7f6-4vx5-4263
Summary: Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP
Aliases: CVE-2020-15839
Severity: MODERATE
CWE: CWE-434
Published: 2022-02-10T20:46:21Z

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
Vulnerability: GHSA-v7wg-cpwc-24m4
Summary:  Unchecked Class Instantiation when providing Plugin Classes
Aliases: CVE-2022-21724
Severity: HIGH
CWE: CWE-668, CWE-74, CWE-665
Published: 2022-02-02T00:04:20Z

pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. The first impacted version is REL9.4.1208 (it introduced `socketFactory` connection property).
Vulnerability: GHSA-crh4-294p-vcfq
Summary: Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Severity: HIGH
CWE: CWE-400
Published: 2021-04-19T14:53:20Z

Unsafe validation RegEx in `EmailField` component in `com.vaadin:vaadin-text-field-flow` versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

- https://vaadin.com/security/cve-2021-31405
Vulnerability: GHSA-qh3m-qw6v-qvhg
Summary: Moderate severity vulnerability that affects io.vertx:vertx-core
Aliases: CVE-2018-12544
Severity: MODERATE
CWE: CWE-611
Published: 2018-10-17T16:20:32Z

In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.
Vulnerability: GHSA-96jq-75wh-2658
Summary: Moderate severity vulnerability that affects apache axis
Aliases: CVE-2018-8032
Severity: MODERATE
CWE: CWE-79
Published: 2018-10-16T20:51:15Z

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
Vulnerability: GHSA-jjhw-5mxp-2g2q
Summary: Cross-site Scripting in OpenNMS Horizon
Aliases: CVE-2021-25933
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-25T18:47:01Z

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.
Vulnerability: GHSA-7m27-3587-83xf
Summary: Privilege Defined With Unsafe Actions in Keycloak
Aliases: CVE-2019-10170
Severity: HIGH
CWE: CWE-267
Published: 2021-10-21T17:46:27Z

A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.
Vulnerability: GHSA-ffjh-fjgg-mfpq
Summary: Moderate severity vulnerability that affects org.apache.ranger:ranger
Aliases: CVE-2017-7677
Severity: MODERATE
CWE: CWE-862
Published: 2018-10-17T17:22:49Z

In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table.
Vulnerability: GHSA-8222-6fc8-mhvf
Summary: Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
Aliases: CVE-2019-3773
Severity: CRITICAL
CWE: CWE-611
Published: 2019-01-25T16:18:52Z

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Vulnerability: GHSA-h376-j262-vhq6
Summary: RCE in H2 Console
Aliases: CVE-2021-42392
Severity: CRITICAL
CWE: CWE-502
Published: 2022-01-06T23:55:09Z

### Impact
H2 Console in versions since 1.1.100 (2008-10-14) to 2.0.204 (2021-12-21) inclusive allows loading of custom classes from remote servers through JNDI.

H2 Console doesn't accept remote connections by default. If remote access was enabled explicitly and some protection method (such as security constraint) wasn't set, an intruder can load own custom class and execute its code in a process with H2 Console (H2 Server process or a web server with H2 Console servlet).

It is also possible to load them by creation a linked table in these versions, but it requires `ADMIN` privileges and user with `ADMIN` privileges has full access to the Java process by design. These privileges should never be granted to untrusted users.

### Patches
Since version 2.0.206 H2 Console and linked tables explicitly forbid attempts to specify LDAP URLs for JNDI. Only local data sources can be used.

### Workarounds
H2 Console should never be available to untrusted users.

`-webAllowOthers` is a dangerous setting that should be avoided.

H2 Console Servlet deployed on a web server can be protected with a security constraint:
https://h2database.com/html/tutorial.html#usingH2ConsoleServlet
If `webAllowOthers` is specified, you need to uncomment and edit `<security-role>` and `<security-constraint>` as necessary. See documentation of your web server for more details.

### References
This issue was found and privately reported to H2 team by [JFrog Security](https://www.jfrog.com/)'s vulnerability research team with detailed information.
Vulnerability: GHSA-7px3-6f6g-hxcj
Summary: Moderate severity vulnerability that affects org.apache.solr:solr-core
Aliases: CVE-2018-8026
Severity: MODERATE
CWE: CWE-611
Published: 2018-10-17T19:55:34Z

This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. The manipulated files can be uploaded as configsets using Solr's API, allowing to exploit that vulnerability.
Vulnerability: GHSA-p7jq-v8jp-j424
Summary: Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
Aliases: CVE-2021-31406
Severity: MODERATE
CWE: CWE-208, CWE-203
Published: 2021-04-19T14:50:38Z

Non-constant-time comparison of CSRF tokens in endpoint request handler in `com.vaadin:flow-server` versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.

- https://vaadin.com/security/cve-2021-31406
Vulnerability: GHSA-p2v9-g2qv-p635
Summary: HTTP Request Smuggling in Netty
Aliases: CVE-2019-20445
Severity: MODERATE
CWE: CWE-444
Published: 2020-02-21T18:55:04Z

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
Vulnerability: GHSA-mh27-rxmr-8q4c
Summary: Cross-site Scripting in Jenkins SiteMonitor Plugin
Aliases: CVE-2022-28153
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-30T00:00:23Z

Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Vulnerability: GHSA-85cw-hj65-qqv9
Summary: Polymorphic Typing issue in FasterXML jackson-databind
Aliases: CVE-2019-16335
Severity: CRITICAL
CWE: CWE-502
Published: 2019-09-23T18:33:45Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
Vulnerability: GHSA-p6j8-hgv5-m35g
Summary: Uncontrolled Resource Consumption in jboss-remoting
Aliases: CVE-2020-35510
Severity: HIGH
CWE: CWE-400
Published: 2022-03-18T17:58:30Z

A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Vulnerability: GHSA-9qcf-c26r-x5rf
Summary: XML external entity injection in Terracotta Quartz Scheduler
Aliases: CVE-2019-13990
Severity: CRITICAL
CWE: CWE-611
Published: 2020-07-01T17:55:03Z

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
Vulnerability: GHSA-88cc-g835-76rp
Summary: Improper Restriction of XML External Entity Reference
Aliases: CVE-2020-13692
Severity: HIGH
CWE: CWE-611
Published: 2022-02-10T00:30:07Z

PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
Vulnerability: GHSA-j6qj-j888-vvgq
Summary: Directory exposure in jetty
Aliases: CVE-2021-28163
Severity: LOW
CWE: CWE-200, CWE-59
Published: 2021-04-06T17:32:00Z

### Impact
If the `${jetty.base}` directory or the `${jetty.base}/webapps` directory is a symlink (soft link in Linux), the contents of the `${jetty.base}/webapps` directory may be deployed as a static web application, exposing the content of the directory for download. 

For example, the problem manifests in the following `${jetty.base}`:
```$ tree demo-base/
demo-base/
├── etc
├── lib
├── resources
├── start.d
├── deploy
│   └── async-rest.war
└── webapps -> deploy

``` 

### Workarounds
Do not use a symlink
Vulnerability: GHSA-45h5-r968-5xr7
Summary: Exposure of sensitive information in Elasticsearch
Aliases: CVE-2021-22147
Severity: MODERATE
CWE: CWE-732
Published: 2021-09-20T20:29:40Z

A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.
Vulnerability: GHSA-vwx4-frpr-w27j
Summary: Improper Synchronization in Jenkins Convertigo Mobile Platform Plugin
Aliases: CVE-2022-25210
Severity: MODERATE
CWE: CWE-662, CWE-820
Published: 2022-02-16T00:01:14Z

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured.
Vulnerability: GHSA-4gf2-xv97-63m2
Summary: Exposure of Sensitive Information in keycloak
Aliases: CVE-2020-1744
Severity: MODERATE
CWE: CWE-755, CWE-200
Published: 2021-09-20T20:43:24Z

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
Vulnerability: GHSA-45vg-2v73-vm62
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2015-0201
Severity: MODERATE
Published: 2018-10-17T20:28:20Z

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.
Vulnerability: GHSA-8p83-68cw-943f
Summary: Apache Ignite communicates to an external PHP server where sensitive information is sent
Aliases: CVE-2017-7686
Severity: HIGH
CWE: CWE-200
Published: 2018-10-16T20:53:20Z

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.
Vulnerability: GHSA-2vxm-vp4c-fjfw
Summary: Authentication Bypass in Apache Cassandra
Aliases: CVE-2020-17516
Severity: HIGH
CWE: CWE-290
Published: 2022-02-09T01:01:22Z

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.
Vulnerability: GHSA-gv5f-cjw9-5vxg
Summary: Camel-xstream component in Apache Camel can allow remote attackers to execute arbitrary commands 
Aliases: CVE-2015-5344
Severity: CRITICAL
Published: 2018-10-16T23:10:23Z

The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Vulnerability: GHSA-p92q-7fhh-mq35
Summary: Cross-Site Request Forgery in Jenkins
Aliases: CVE-2022-20612
Severity: MODERATE
CWE: CWE-352
Published: 2022-01-21T23:37:57Z

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
Vulnerability: GHSA-rpj6-2q8r-98f8
Summary: Incorrect default pattern in Jenkins Audit Trail Plugin 
Aliases: CVE-2020-2287
Severity: MODERATE
CWE: CWE-435
Published: 2022-02-10T20:29:39Z

Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths than the Stapler web framework uses for dispatching requests, which allows attackers to craft URLs that bypass request logging of any target URL.
Vulnerability: GHSA-8fp4-rp6c-5gcv
Summary: Path Traversal in com.linecorp.armeria:armeria
Aliases: CVE-2021-43795
Severity: HIGH
CWE: CWE-22
Published: 2021-12-02T22:25:54Z

### Impact

An attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic.

### Patches

Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. 

### Workarounds

This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path, e.g.

```java
Server
  .builder()
  .serviceUnder(
    "/files",
    FileService
      .of(...)
      .decorate((delegate, ctx, req) -> {
        String path = req.headers().path();
        if (path.contains("%2f") || path.contains("%2F")) {
          return HttpResponse.of(HttpStatus.BAD_REQUEST);
        }
        return delegate.serve(ctx, req);
      })
  )
  .build()
```

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [line/armeria](https://github.com/line/armeria)
* Chat with us at [Slack](https://armeria.dev/s/slack)

### Credits

This vulnerability was originally reported by Abdallah Zaher ([elcayser-0x0a](https://hackerone.com/elcayser-0x0a?type=user)).
Vulnerability: GHSA-2rvv-w9r2-rg7m
Summary: Information Disclosure in Apache Tomcat
Aliases: CVE-2021-24122
Severity: MODERATE
CWE: CWE-200
Published: 2021-05-13T22:30:02Z

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
Vulnerability: GHSA-56p8-3fh9-4cvq
Summary: XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)
Aliases: CVE-2021-21348
Severity: MODERATE
CWE: CWE-502, CWE-400
Published: 2021-03-22T23:29:09Z

### Impact
The vulnerability may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21348](https://x-stream.github.io/CVE-2021-21348.html).

### Credits
The vulnerability was discovered and reported by threedr3am.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-cvm9-fjm9-3572
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36181
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:16:10Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.
Vulnerability: GHSA-89qr-369f-5m5x
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36182
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:15:46Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.
Vulnerability: GHSA-w9p3-5cr8-m3jj
Summary: Deserialization of Untrusted Data in Log4j 1.x
Aliases: CVE-2022-23302
Severity: HIGH
CWE: CWE-502
Published: 2022-01-21T23:27:14Z

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Vulnerability: GHSA-4fgq-gq9g-3rw7
Summary: Improper Verification of Cryptographic Signature in keycloak
Aliases: CVE-2019-10201
Severity: MODERATE
CWE: CWE-347
Published: 2019-09-23T18:32:16Z

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
Vulnerability: GHSA-758m-v56v-grj4
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-10969
Severity: HIGH
CWE: CWE-502
Published: 2020-04-23T21:36:03Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
Vulnerability: GHSA-c597-f74m-jgc2
Summary: Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak
Aliases: CVE-2020-1758
Severity: MODERATE
CWE: CWE-295, CWE-297
Published: 2022-02-09T00:56:26Z

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.
Vulnerability: GHSA-5c66-v29h-xjh8
Summary: XSS Cross Site Scripting
Aliases: CVE-2021-29459
Severity: CRITICAL
CWE: CWE-79
Published: 2021-04-22T16:11:55Z

### Impact
It is possible to persistently inject scripts in XWiki.

For unregistred users:
- By filling simple text fields

For registered users:
- By filling their personal information
- (if they have edit rights) By filling the values of static lists using App Within Minutes

That can lead to user's session hijacking, and if used in conjunction with a social engineering attack it can also lead to disclosure of sensitive data, CSRF attacks and other security vulnerabilities.
That can also lead to the attacker taking over an account.
If the victim has administrative rights it might even lead to code execution on the server, depending on the application and the privileges of the account.
### Patches
It has been patched on XWiki 12.8 and 12.6.3.

### Workarounds
There is no easy workaround except upgrading XWiki.

### References
https://jira.xwiki.org/browse/XWIKI-17374

### For more information
If you have any questions or comments about this advisory:
  * Open an issue in [Jira XWiki](https://jira.xwiki.org)
  * Email us at our [security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-4vhj-98r6-424h
Summary: In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate
Aliases: CVE-2016-1000338
Severity: HIGH
CWE: CWE-347
Published: 2018-10-17T16:23:26Z

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Vulnerability: GHSA-grpf-gg7v-5g5h
Summary: SQL Injection in Apache SkyWalking
Aliases: CVE-2020-13921
Severity: CRITICAL
CWE: CWE-89
Published: 2021-05-07T15:53:31Z

Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.
Vulnerability: GHSA-m7jv-hq7h-mq7c
Summary: Infinite Loop in Apache Tomcat
Aliases: CVE-2020-13935
Severity: HIGH
CWE: CWE-835
Published: 2022-02-08T22:05:17Z

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
Vulnerability: GHSA-hjgm-f7vx-m5g7
Summary: Deserialization of Untrusted Data in Apache Heron
Aliases: CVE-2020-1964
Severity: HIGH
CWE: CWE-502
Published: 2022-01-06T19:44:49Z

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).
Vulnerability: GHSA-x825-rjww-2245
Summary: Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user
Aliases: CVE-2017-9799
Severity: HIGH
Published: 2018-10-17T18:30:01Z

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
Vulnerability: GHSA-c265-37vj-cwcc
Summary: Deserialization of untrusted data in Jackson Databind
Aliases: CVE-2020-14062
Severity: HIGH
CWE: CWE-502
Published: 2020-06-18T14:44:48Z

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).
Vulnerability: GHSA-rjx9-2936-9ffx
Summary: Improper Input Validation in Apache Sanselan
Aliases: CVE-2018-17201
Severity: HIGH
CWE: CWE-20
Published: 2019-05-14T04:01:06Z

Certain input files could make the code hang when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.
Vulnerability: GHSA-hwvm-vfw8-93mw
Summary: Vulnerable dependency in XTDB connector
Severity: MODERATE
Published: 2021-12-16T18:53:32Z

### Impact

The impacted portion of the XTDB connector is its connectivity to S3 as a backing store: this is the only portion of the connector that uses this vulnerable `httpclient` dependency. Per the description, the vulnerability regards URIs that may be misinterpreted, which given the area of impact within the connector we understand to be any URI used to configure connectivity to S3. Note therefore that if you do not use or configure S3 as a backing store in your use of the connector, you should not be exposed to any vulnerability from this component.

### Patches

The problem has been addressed in version 4.5.13 of the httpclient library, which is included as a replacement dependency version for the build of the XTDB connector from release 3.5 onwards. Therefore, using release 3.5 (or newer) of the connector will include the fixes to address this CVE.

### Workarounds

We have not investigated specific workarounds, but per the description of the issue it seems likely that ensuring the proper URIs are used for any S3 connectivity used by the connector (and ensuring there are appropriate controls around modifying such URIs in the connector's configuration) would be the first point of investigation.

### References

https://nvd.nist.gov/vuln/detail/CVE-2020-13956
Vulnerability: GHSA-xf46-8vvp-4hxx
Summary: Missing authentication for critical function
Aliases: CVE-2021-20262
Severity: MODERATE
CWE: CWE-306
Published: 2021-03-12T21:33:42Z

A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if they can obtain temporary, physical access to a user’s browser. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Vulnerability: GHSA-w4r4-65mg-45x2
Summary: Moderate severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
Aliases: CVE-2018-11770
Severity: MODERATE
CWE: CWE-287
Published: 2018-11-09T17:41:46Z

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future 2.4.x versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.
Vulnerability: GHSA-344f-f5vg-2jfj
Summary: Potential remote code execution in Apache Tomcat
Aliases: CVE-2020-9484
Severity: HIGH
CWE: CWE-502
Published: 2020-05-21T18:52:29Z

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
Vulnerability: GHSA-37g7-8vjj-pjpj
Summary: Hash flooding
Aliases: CVE-2020-14326
Severity: HIGH
CWE: CWE-400
Published: 2022-03-18T17:58:59Z

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service.
Vulnerability: GHSA-2hjr-fg6c-v2h6
Summary: Unauthorized access to Class instance in Jinjava
Aliases: CVE-2020-12668
Severity: MODERATE
CWE: CWE-200
Published: 2022-02-09T00:33:56Z

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.
Vulnerability: GHSA-ffm7-7r8g-77xm
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache CXF
Aliases: CVE-2020-1954
Severity: MODERATE
CWE: CWE-200
Published: 2022-02-10T22:38:50Z

Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory’ property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent and received over JMX.