deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-pw86-qvx9-34r7
Package: com.liferay:com.liferay.portal.security.audit.storage.service (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 6.0.4, < 6.0.41
Patched in: 6.0.41

Summary: Liferay Portal Vulnerable to IDOR via audit events

Details:
Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users to from one virtual instance to view the audit events from a different virtual instance via the `_com_liferay_portal_security_audit_web_portlet_AuditPortlet_auditEventId` parameter.
GitHub Security Advisory: GHSA-pw86-qvx9-34r7
Package: com.liferay:com.liferay.portal.security.audit.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 5.0.1, < 5.0.33
Patched in: 5.0.33

Summary: Liferay Portal Vulnerable to IDOR via audit events

Details:
Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users to from one virtual instance to view the audit events from a different virtual instance via the `_com_liferay_portal_security_audit_web_portlet_AuditPortlet_auditEventId` parameter.
GitHub Security Advisory: GHSA-gx2c-fvhc-ph4j
Package: org.apache.hadoop:hadoop-common (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.3.0, < 3.3.3
Patched in: 3.3.3

Summary: Path traversal in Hadoop

Details:
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 2.10.2, 3.2.3, 3.3.3, and 3.4.0.
GitHub Security Advisory: GHSA-gx2c-fvhc-ph4j
Package: org.apache.hadoop:hadoop-common (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2.10.2
Patched in: 2.10.2

Summary: Path traversal in Hadoop

Details:
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 2.10.2, 3.2.3, 3.3.3, and 3.4.0.
GitHub Security Advisory: GHSA-gx2c-fvhc-ph4j
Package: org.apache.hadoop:hadoop-common (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.2.0, < 3.2.3
Patched in: 3.2.3

Summary: Path traversal in Hadoop

Details:
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 2.10.2, 3.2.3, 3.3.3, and 3.4.0.
GitHub Security Advisory: GHSA-jv8x-mm3v-75r7
Package: com.liferay:com.liferay.journal.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.34, < 5.0.161
Patched in: 5.0.161

Summary: Liferay Portal vulnerable to cross-site scripting in the web content template

Details:
Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a web content structure's Name text field
GitHub Security Advisory: GHSA-jv8x-mm3v-75r7
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.3.4-ga4, <= 7.4.3.111-ga111
Patched in: 7.4.3.112-ga112

Summary: Liferay Portal vulnerable to cross-site scripting in the web content template

Details:
Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a web content structure's Name text field
GitHub Security Advisory: GHSA-2hm7-r8f3-423h
Package: com.liferay.portal:com.liferay.portal.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 96.0.0
Patched in: 96.0.0

Summary: Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet

Details:
Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files multiple times via the query string in a URL.
GitHub Security Advisory: GHSA-2hm7-r8f3-423h
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 7.4.0-ga1, <= 7.4.3.107-ga107
Patched in: 7.4.3.108-ga108

Summary: Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet

Details:
Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files multiple times via the query string in a URL.
GitHub Security Advisory: GHSA-m4hg-46pw-6mmv
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.3.74-ga74, <= 7.4.3.111-ga111
Patched in: 7.4.3.112-ga112

Summary: Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter

Details:
Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the `redirect` parameter to (1) Announcements, or (2) Alerts.
GitHub Security Advisory: GHSA-gj92-p9mh-83j8
Package: com.liferay:com.liferay.calendar.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.45, < 5.0.87
Patched in: 5.0.87

Summary: Liferay Portal vulnerable to cross-site scripting in the Calendar widget

Details:
Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Calendar's “Name” text field
GitHub Security Advisory: GHSA-pf86-4w35-cj89
Package: com.liferay:com.liferay.calendar.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.45, < 5.0.88
Patched in: 5.0.88

Summary: Liferay Portal vulnerable to cross-site scripting in the Calendar widget

Details:
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle text, or (3) Last Name text fields.
GitHub Security Advisory: GHSA-pf86-4w35-cj89
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.3.35-ga35, <= 7.4.3.110-ga110
Patched in: 7.4.3.111-ga111

Summary: Liferay Portal vulnerable to cross-site scripting in the Calendar widget

Details:
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle text, or (3) Last Name text fields.
GitHub Security Advisory: GHSA-wmjx-xv9v-r89q
Package: com.liferay:com.liferay.product.navigation.control.menu.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.80, < 6.0.83
Patched in: 6.0.83

Summary: Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page

Details:
Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5 allows remote attackers to inject arbitrary web script or HTML via the com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURLTitle parameter.
GitHub Security Advisory: GHSA-2856-xf2f-6vrf
Package: com.liferay:com.liferay.item.selector.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.0.35, < 7.0.52
Patched in: 7.0.52

Summary: Liferay Portal vulnerable to cross-site scripting in the related asset selector

Details:
Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted payload injected into an asset author’s (1) First Name, (2) Middle Name, or (3) Last Name text field.
GitHub Security Advisory: GHSA-jf9v-fxfq-wm76
Package: net.liftweb:lift-webkit_2.9.1 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 2.5
Patched in: 2.5

Summary: Lift Sensitive Information Disclosure

Details:
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
GitHub Security Advisory: GHSA-jf9v-fxfq-wm76
Package: net.liftweb:lift-webkit_2.9.0-1 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 2.5
Patched in: unpatched

Summary: Lift Sensitive Information Disclosure

Details:
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
GitHub Security Advisory: GHSA-jf9v-fxfq-wm76
Package: net.liftweb:lift-webkit_2.9.0 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 2.5
Patched in: unpatched

Summary: Lift Sensitive Information Disclosure

Details:
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
GitHub Security Advisory: GHSA-jf9v-fxfq-wm76
Package: net.liftweb:lift-webkit_2.8.2 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 2.5
Patched in: unpatched

Summary: Lift Sensitive Information Disclosure

Details:
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
GitHub Security Advisory: GHSA-jf9v-fxfq-wm76
Package: net.liftweb:lift-webkit_2.8.1 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 2.5
Patched in: unpatched

Summary: Lift Sensitive Information Disclosure

Details:
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
GitHub Security Advisory: GHSA-jf9v-fxfq-wm76
Package: net.liftweb:lift-webkit_2.8.0 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 2.5
Patched in: unpatched

Summary: Lift Sensitive Information Disclosure

Details:
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
GitHub Security Advisory: GHSA-jf9v-fxfq-wm76
Package: net.liftweb:lift-webkit_2.7.7 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 2.5
Patched in: unpatched

Summary: Lift Sensitive Information Disclosure

Details:
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
GitHub Security Advisory: GHSA-jf9v-fxfq-wm76
Package: net.liftweb:lift-webkit (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 2.5
Patched in: unpatched

Summary: Lift Sensitive Information Disclosure

Details:
The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
GitHub Security Advisory: GHSA-ww3v-6xjf-jv28
Package: io.spray:spray-json_2.9.3 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.5
Patched in: unpatched

Summary: Uncontrolled Resource Consumption in Spray JSON

Details:
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
GitHub Security Advisory: GHSA-ww3v-6xjf-jv28
Package: io.spray:spray-json_2.13.0-M5 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.5
Patched in: 1.3.5

Summary: Uncontrolled Resource Consumption in Spray JSON

Details:
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
GitHub Security Advisory: GHSA-ww3v-6xjf-jv28
Package: io.spray:spray-json_2.13.0-M4 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.5
Patched in: unpatched

Summary: Uncontrolled Resource Consumption in Spray JSON

Details:
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
GitHub Security Advisory: GHSA-ww3v-6xjf-jv28
Package: io.spray:spray-json_2.13.0-M2 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.5
Patched in: unpatched

Summary: Uncontrolled Resource Consumption in Spray JSON

Details:
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
GitHub Security Advisory: GHSA-ww3v-6xjf-jv28
Package: io.spray:spray-json_2.12.0-RC2 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.5
Patched in: unpatched

Summary: Uncontrolled Resource Consumption in Spray JSON

Details:
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
GitHub Security Advisory: GHSA-ww3v-6xjf-jv28
Package: io.spray:spray-json_2.12.0-RC1 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.5
Patched in: unpatched

Summary: Uncontrolled Resource Consumption in Spray JSON

Details:
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
GitHub Security Advisory: GHSA-ww3v-6xjf-jv28
Package: io.spray:spray-json_2.12.0-M5 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.5
Patched in: unpatched

Summary: Uncontrolled Resource Consumption in Spray JSON

Details:
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
GitHub Security Advisory: GHSA-ww3v-6xjf-jv28
Package: io.spray:spray-json_2.12.0-M3 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.5
Patched in: unpatched

Summary: Uncontrolled Resource Consumption in Spray JSON

Details:
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
GitHub Security Advisory: GHSA-ww3v-6xjf-jv28
Package: io.spray:spray-json_2.12 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.5
Patched in: 1.3.5

Summary: Uncontrolled Resource Consumption in Spray JSON

Details:
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
GitHub Security Advisory: GHSA-ww3v-6xjf-jv28
Package: io.spray:spray-json_2.11.0-RC4 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.5
Patched in: unpatched

Summary: Uncontrolled Resource Consumption in Spray JSON

Details:
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
GitHub Security Advisory: GHSA-ww3v-6xjf-jv28
Package: io.spray:spray-json_2.11 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.5
Patched in: 1.3.5

Summary: Uncontrolled Resource Consumption in Spray JSON

Details:
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
GitHub Security Advisory: GHSA-ww3v-6xjf-jv28
Package: io.spray:spray-json_2.10 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.5
Patched in: 1.3.5

Summary: Uncontrolled Resource Consumption in Spray JSON

Details:
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
GitHub Security Advisory: GHSA-55vq-xpjf-r2xc
Package: com.typesafe.akka:akka-stream-kafka_2.11 (MAVEN)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-312: Cleartext Storage of Sensitive Information, CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: < 4.0.2
Patched in: unpatched

Summary: Lightbend Alpakka Kafka logs credentials on debug level

Details:
Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
GitHub Security Advisory: GHSA-55vq-xpjf-r2xc
Package: com.typesafe.akka:akka-stream-kafka_2.12 (MAVEN)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-312: Cleartext Storage of Sensitive Information, CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: < 4.0.2
Patched in: 4.0.2

Summary: Lightbend Alpakka Kafka logs credentials on debug level

Details:
Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.