CVE-2017-12629

Solr: Code execution via entity expansion

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

CVSS 3.1 · 9.8 Critical EPSS 92.5% KEV · Not listed

Vendors

Apache Canonical Debian and 1 more

Products

Solr Ubuntu Linux Debian Linux and 6 more

CVE-2022-3782

keycloak: path traversal via double URL encoding

keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.

CVSS 3.1 · 9.1 Critical EPSS 6.2% KEV · Not listed

Vendors

Redhat

Products

Amq Broker Jboss Enterprise Bpms Platform Keycloak and 5 more

CVE-2022-3143

wildfly-elytron: possible timing attacks via use of unsafe comparator

wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus Jboss Enterprise Bpms Platform and 1 more

CVE-2023-0482

RESTEasy: creation of insecure temp files

In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Netapp Redhat

Products

Active Iq Unified Manager Oncommand Workflow Automation Amq Broker and 7 more

CVE-2022-4492

undertow: Server identity in https connection is not checked by the undertow client

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Of Quarkus Camel Spring Boot Integration Camel For Spring Boot and 14 more

CVE-2023-20861

springframework: Spring Expression DoS Vulnerability

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Vmware

Products

Amq Broker Camel Spring Boot Jboss Enterprise Bpms Platform and 5 more

CVE-2023-20860

springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed

Vendors

Redhat Vmware

Products

Amq Broker Camel Spring Boot Jboss Enterprise Bpms Platform and 6 more

CVE-2022-44730

Apache XML Graphics Batik: Information disclosure vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apache Debian Redhat

Products

Xml Graphics Batik Debian Linux Camel Spring Boot and 1 more

CVE-2019-0231

Apache MINA SSLFilter security Issue

Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Apache Redhat

Products

Mina Jboss Enterprise Bpms Platform Jboss Enterprise Brms Platform and 3 more

CVE-2023-20883

spring-boot: Spring Boot Welcome Page DoS Vulnerability

In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat Vmware

Products

Camel Spring Boot Jboss Enterprise Bpms Platform Jboss Fuse and 2 more

CVE-2019-9515

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVSS 3.1 · 7.5 High EPSS 87.3% KEV · Not listed

Vendors

Apache Apple Canonical and 9 more

Products

Traffic Server Mac Os X Swiftnio and 33 more

CVE-2019-9518

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.

CVSS 3.1 · 7.5 High EPSS 25.4% KEV · Not listed

Vendors

Apache Apple Canonical and 8 more

Products

Traffic Server Mac Os X Swiftnio and 23 more

CVE-2019-9514

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

CVSS 3.1 · 7.5 High EPSS 82.8% KEV · Not listed

Vendors

Apache Apple Canonical and 10 more

Products

Traffic Server Mac Os X Swiftnio and 41 more

CVE-2023-33201

bouncycastle: potential blind LDAP injection attack using a self-signed certificate

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bouncycastle Redhat

Products

Bc-java Amq Broker Amq Streams and 7 more

CVE-2023-6481

Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qos Redhat

Products

Logback Amq Broker Camel Spring Boot and 3 more

CVE-2023-3635

Okio GzipSource unhandled exception Denial of Service

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

CVSS 3.1 · 5.9 Medium EPSS 1.3% KEV · Not listed

Vendors

Redhat Squareup

Products

Amq Streams Jboss Enterprise Bpms Platform Jboss Fuse and 3 more

CVE-2023-3223

Undertow: outofmemoryerror due to @multipartconfig handling

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Integration Jboss Data Grid and 18 more

CVE-2023-1108

Undertow: infinite loop in sslconduit during close

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Netapp Redhat

Products

Oncommand Workflow Automation Build Of Quarkus Camel Quarkus and 26 more

CVE-2022-4245

Codehaus-plexus: xml external entity (xxe) injection

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Codehaus-plexus Redhat

Products

Plexus-utils A Mq Clients Amq Broker and 20 more

CVE-2022-42920

Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed

Vendors

Apache Fedoraproject Redhat

Products

Commons Bcel Fedora Amq Streams and 7 more