org.grails:grails-logging (2.3.0.m2), org.grails:grails-plugin-async (2.3.0.m2) +19 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.3.0.m2)

org.grails:grails-core MAVEN version 2.3.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-logging 2.3.0.m2 - org.grails:grails-plugin-async 2.3.0.m2 - org.grails:grails-plugin-codecs...

org.grails:grails-datastore-gorm-grails2-support (>=6.0.0.rc1, <=6.1.0.rc2), org.grails:grails-datastore-gorm-grails2-test (>=6.0.0.rc1, <=6.1.0.rc2) +35 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.5.5)

org.grails:grails-core MAVEN version 2.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm-grails2-support =6.0.0.rc1, =6.0.0.rc1, =6.1.0.rc2 - org.grails:grails-dependencie...

Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...

org.jboss.resteasy:abdera-atom-provider (1.1.ga), org.jboss.resteasy:async-http-servlet-3.0 (1.1.ga) +6 more potentially affected by CVE-2016-6346 via org.jboss.resteasy:resteasy-jaxrs (1.1.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 1.1.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - org.jboss.resteasy:abdera-atom-provider 1.1.ga - org.jboss.resteasy:async-http-servlet-3.0...

org.chtijbug.drools:guvnor-jaxb-entities (5.6.2.chtijbug), org.drools:guvnor-jaxb-entities (>=5.6.0.cr1, <=5.6.0.final) +18 more potentially affected by CVE-2016-6346 via org.jboss.resteasy:resteasy-jaxrs (2.2.3.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 2.2.3.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - org.chtijbug.drools:guvnor-jaxb-entities 5.6.2.chtijbug - org.drools:guvnor-jaxb-entities...

com.logiclander.jaasmine:jaasmine-web (1.0.0), net.ju-n.bonita.connectors:bonita-qrcode-connector (0.2) +16 more potentially affected by CVE-2016-6346 via org.jboss.resteasy:resteasy-jaxrs (1.2.1.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 1.2.1.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - com.logiclander.jaasmine:jaasmine-web 1.0.0 -...

io.github.ryan-za:async-elastic-orm (0.2.2) potentially affected by CVE-2018-3824 via org.elasticsearch:elasticsearch (1.0.0.beta2)

org.elasticsearch:elasticsearch MAVEN version 1.0.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - io.github.ryan-za:async-elastic-orm 0.2.2 Source cves: CVE-2018-3824 Source advisory:...

io.github.ryan-za:async-elastic-orm (0.2.2) potentially affected by CVE-2019-7611 via org.elasticsearch:elasticsearch (1.0.0.beta2)

org.elasticsearch:elasticsearch MAVEN version 1.0.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - io.github.ryan-za:async-elastic-orm 0.2.2 Source cves: CVE-2019-7611 Source advisory:...

Insufficient Verification of Data Authenticity in Async Http Client

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client aka AHC or async-http-client before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate...

Insufficient Verification of Data Authenticity in Async Http Client

Async Http Client aka AHC or async-http-client before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a...

GHSA-5C66-6H6G-6Q6M Insufficient Verification of Data Authenticity in Async Http Client

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client aka AHC or async-http-client before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate...

GHSA-8H53-FJGG-G42G Insufficient Verification of Data Authenticity in Async Http Client

Async Http Client aka AHC or async-http-client before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a...

7ghost (>=4.11.0, <=4.11.46), 90crew-sqlite-async (0.0.4) +195 more potentially affected by CVE-2022-21227 via sqlite3 (>=5.0.0, <=5.0.2)

sqlite3 NPM version =5.0.0, =4.11.0, =0.1.0, =1.1.0, =12.1.0-alpha.6, =2.0.11, =0.2.5, =0.1.3-alpha.0, =0.1.19-alpha.0, =0.1.11-alpha.0, =0.1.3-alpha.0, =7.0.0-alpha.18, =7.3.8 and more Source cves: CVE-2022-21227 Source advisory: OSV:GHSA-9QRH-QJMC-5W2P...

Important: Red Hat Security Advisory: Satellite 6.9.9 Async Bug Fix Update

Updated Satellite 6.9 packages that fix several bugs are now available for Red Hat Satellite. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other clien...

Prototype Pollution

async is vulnerable to prototype pollution. An attacker is able to inject malicious property types via mapValues method and gain unintended privileges due to prototype pollution vulnerability...

@0xcert/ethereum-bitski-backend-provider (>=2.0.0-alpha10, <=2.0.3), @0xcert/ethereum-bitski-frontend-provider (>=2.0.0-alpha10, <=2.0.3) +844 more potentially affected by CVE-2021-43138 via async (>=3.0.0, <=3.2.1)

async NPM version =3.0.0, =2.0.0-alpha10, =2.0.0-alpha10, =4.3.0, =0.0.6-1, =3.6.5, =0.0.73, =1.5.1, =1.7.58, =0.0.1, =1.3.6, =13.0.6, =5.1.1, =1.3.1, =0.0.2-next.4, =0.4.0-next.28 - @ahm-monash/private-test 1.0.0 and more Source cves: CVE-2021-43138 Source advisory: GHSA-FWR7-V2MV-HH25...

1405-authtokens (>=1.0.1, <=1.0.5), 1405_logging (1.0.0) +7521 more potentially affected by CVE-2021-43138 via async (>=2.0.0, <=2.6.3)

async NPM version =2.0.0, =1.0.1, =2.3.0, =1.0.7, =0.0.1, =0.0.2, =0.0.2, =0.3.0, =0.4.0, =1.2.2 - @36node/template-service 0.3.5 and more Source cves: CVE-2021-43138 Source advisory: OSV:GHSA-FWR7-V2MV-HH25...

@0xcert/ethereum-bitski-backend-provider (>=2.0.0-alpha10, <=2.0.3), @0xcert/ethereum-bitski-frontend-provider (>=2.0.0-alpha10, <=2.0.3) +844 more potentially affected by CVE-2021-43138 via async (>=3.0.0, <=3.2.1)

async NPM version =3.0.0, =2.0.0-alpha10, =2.0.0-alpha10, =4.3.0, =0.0.6-1, =3.6.5, =0.0.73, =1.5.1, =1.7.58, =0.0.1, =1.3.6, =13.0.6, =5.1.1, =1.3.1, =0.0.2-next.4, =0.4.0-next.28 - @ahm-monash/private-test 1.0.0 and more Source cves: CVE-2021-43138 Source advisory: OSV:GHSA-FWR7-V2MV-HH25...

1405-authtokens (>=1.0.1, <=1.0.5), 1405_logging (1.0.0) +7521 more potentially affected by CVE-2021-43138 via async (>=2.0.0, <=2.6.3)

async NPM version =2.0.0, =1.0.1, =2.3.0, =1.0.7, =0.0.1, =0.0.2, =0.0.2, =0.3.0, =0.4.0, =1.2.2 - @36node/template-service 0.3.5 and more Source cves: CVE-2021-43138 Source advisory: GHSA-FWR7-V2MV-HH25...

Prototype Pollution in async

A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x fixed in 3.2.2 and 2.6.4, which could let a malicious user obtain privileges via the mapValues method...