1701 matches found
PT-2017-12613
Name of the Vulnerable Software and Affected Versions Apache Camel versions 2.0.0 through 2.19.3 Apache Camel versions 2.20.0 through 2.20.0 Description The camel-hessian component in Apache Camel is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead ...
Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update
An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
camel-core: Validation component vulnerable to SSRF via remote DTDs and XXE
It was found that Apache Camel's validation component evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can use this feature to make Server-Side Request Forgery SSRF attacks by sending XML documents with remote DTDs URLs or XM...
camel-jacksonxml: Unmarshalling operation are vulnerable to RCE
It was found that Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in vario...
camel-snakeyaml: Unmarshalling operation is vulnerable to RCE
It was found that the camel-snakeyaml component is exploitable for code execution. An attacker could use this vulnerability to send specially crafted payload to a camel-snakeyaml endpoint and causing a remote code execution attack...
Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update
An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
Multiple Remote Code Execution Vulnerabilities in Apache Camel Java Deserialization
Apache Camel is the United States Apache Apache Software Foundation of a set of open source based on Enterprise Integration Pattern Enterprise Integration Pattern, referred to as EIP integration framework. The framework provides Enterprise Integration Pattern Java objects POJO implementation , an...
Remote code execution
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks...
CVE-2016-8749
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks...
CVE-2016-8749
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks...
CVE-2016-8749
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks...
CVE-2016-8749
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks...
CVE-2016-8749
Apache Camel (camel-jackson and camel-jacksonxml) is affected by CVE-2016-8749 due to unsafe Java object deserialization during Jackson/JacksonXML unmarshalling, enabling remote code execution. The issue is documented across multiple feeds (GHSA and Red Hat advisories) and affects Camel component...
CVE-2016-8749: Deserialization of Untrusted Data
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks...
PT-2017-9780
Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 2.16.5 Apache Camel versions prior to 2.17.5 Apache Camel versions prior to 2.18.2 Description The issue concerns a Java object de-serialization vulnerability in Apache Camel's Jackson and JacksonXML unmarshallin...
Apache Camel Validation Component Request Forgery Vulnerability
Apache Camel is the United States Apache Apache Software Foundation of a set of open source based on Enterprise Integration Pattern Enterprise Integration Pattern , referred to as EIP integration framework. The framework provides Enterprise Integration Pattern of Java objects POJO implementation ...
CVE-2017-5643
It was found that Apache Camel's validation component evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can use this feature to make Server-Side Request Forgery SSRF attacks by sending XML documents with remote DTDs URLs or XM...
Server-Side Request Forgery (SSRF)
Apache Camel is vulnerable to Server-Side Request Forgery SSRF via remote DTDs URLs or XML External Entities XXE. This is because the validation component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can...