BIT-ZOOKEEPER-2025-58457 Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, which fixes the issue. The issue can be...

CVE-2025-58457

Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, which fixes the issue. The issue can be...

Improper Handling of Insufficient Permissions or Privileges

Overview org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges...

GHSA-2HMJ-97JW-28JH Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

Improper permission checks in the AdminServer allow an authenticated client with insufficient privileges to invoke the snapshot and restore commands. The intended requirement is authentication and authorization on the root path / with ALL permission for these operations; however, affected version...

CVE-2025-7388

It was possible to perform Remote Command Execution RCE via Java RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and execute OS commands under the delegated authority of the AdminServer process. An RMI interface permitted manipulation of a configuration property...

Linux Distros Unpatched Vulnerability : CVE-2024-51504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based...

CVE-2025-5416 Keycloak-core: keycloak environment information

A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information...

CVE-2023-41043

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server...

CVE-2023-1719

Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to 1 enumerate attachments on the server and 2 execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim ha...

CVE-2019-3467

Debian-edu-config all versions 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals...

CVE-2019-3556

HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the current execution context into a file. The handler takes a parameter which specifies where on the...

CVE-2010-0389

The admin server in Sun Java System Web Server 7.0 Update 6 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via an HTTP request that lacks a method token...

org.noear:solon-admin-server (2.9.2-m1), org.noear:solon-openapi2-knife4j (2.9.2-m1) +3 more potentially affected by CVE-2025-1584 via org.noear:solon-web-staticfiles (2.9.2-m1)

org.noear:solon-web-staticfiles MAVEN version 2.9.2-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.noear:solon-web-staticfiles and may be impacted: - org.noear:solon-admin-server 2.9.2-m1 - org.noear:solon-openapi2-knife4j 2.9.2-m1 -...

com.easy-flowable:easy-flowable-solon-plugin (>=1.0.0, <=1.0.2), com.luomor.pcsms:pcsms-solon-plugin-example (>=1.0.0, <=1.0.1) +17 more potentially affected by CVE-2025-1584 via org.noear:solon-web-staticfiles (>=3.0.0-m1, <=3.0.9-m2)

org.noear:solon-web-staticfiles MAVEN version =3.0.0-m1, =1.0.0, =1.0.0, =2024.3.0, =1.3.0-m1, =20250107, =3.3.4, =1.8.4-m1, =1.3.1, =1.7.8, =1.9.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.9-m2 and more Source cves: CVE-2025-1584 Source advisory: GHSA-X8Q6-CCHR-P7M6...

org.noear:solon-admin-server (2.9.3), org.noear:solon-openapi2-knife4j (2.9.3) +3 more potentially affected by CVE-2025-1584 via org.noear:solon-web-staticfiles (2.9.3)

org.noear:solon-web-staticfiles MAVEN version 2.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.noear:solon-web-staticfiles and may be impacted: - org.noear:solon-admin-server 2.9.3 - org.noear:solon-openapi2-knife4j 2.9.3 -...

org.noear:solon-admin-server (2.9.4), org.noear:solon-openapi2-knife4j (2.9.4) +3 more potentially affected by CVE-2025-1584 via org.noear:solon-web-staticfiles (2.9.4)

org.noear:solon-web-staticfiles MAVEN version 2.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.noear:solon-web-staticfiles and may be impacted: - org.noear:solon-admin-server 2.9.4 - org.noear:solon-openapi2-knife4j 2.9.4 -...

com.consol.citrus:citrus-http (2.2), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +78 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (4.0.7.release)

org.springframework:spring-webmvc MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.consol.citrus:citrus-http 2.2 - de.codecentric:jbehave-admin-server =0.0.1, =1.0....

BIT-ZOOKEEPER-2024-51504 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

CVE-2024-51504

An authentication bypass vulnerability was found in Apache Zookeeper. The default configuration of the client's IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication by spoofing the client's IP address in request...

Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...