CVE-2021-44228_scanner

File system scanner for CVE-2021-44228 Aims to find JndiLookup.class in nearly any directory or zip, jar, ear, war file, even deeply nested. find-class-files – Clojure implementation should be able to run nearly anywhere Java can run, assuming there's enough disk space. Given a set of file system...

CLEANSTART-2024-QB51386 issue in Clojure versions 1

Security vulnerability affects the clojure package. An issue in Clojure versions 1...

GHSA-M835-3CM9-RGGG Joker linter executed project-local .jokerd/linter.* files during linting

Impact In Joker versions before 1.8.2, joker --lint located a .jokerd/ directory by walking up from the linted file and executed matching linter. files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could...

PT-2026-89212

Name of the Vulnerable Software and Affected Versions Joker versions prior to 1.8.2 Description When using the joker --lint command, the software searches for a .jokerd/ directory by traversing upwards from the target file and executes any matching linter. files found within that directory. Since...

Exploit for Deserialization of Untrusted Data in Metabase

CVE-2026-59827: Metabase Unsafe Deserialization in H2 Native Q...

ROOT-APP-MAVEN-CVE-2017-20189 CVE-2017-20189 in io.root.org.clojure:clojure - Patched by Root

Root has patched CVE-2017-20189 in the io.root.org.clojure:clojure package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-22871 CVE-2024-22871 in io.root.org.clojure:clojure - Patched by Root

Root has patched CVE-2024-22871 in the io.root.org.clojure:clojure package for Root:Maven. Multiple fixed versions available...

Ubuntu: Security Advisory (USN-8151-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EUVD-2023-0986

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2017-20189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server...

CVE-2023-28628

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in questio...

Linux Distros Unpatched Vulnerability : CVE-2024-22871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service DoS via the clojure.core$partial$fn5920 function...

CVE-2024-47879

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can...

CVE-2024-47879 OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can...

CVE-2024-47879 OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can...

CVE-2024-47879

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can...

OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

Summary Lack of CSRF protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code. The attacker must know a valid project ID of a project that contains...

GHSA-3JM4-C6QF-JRH3 OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

Summary Lack of CSRF protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code. The attacker must know a valid project ID of a project that contains...

CVE-2024-47879: Cross-Site Request Forgery (CSRF)

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can...

The vulnerability of the Clojure programming language interpreter, related to the deserialization of unreliable data, allows attackers to execute arbitrary code.

The vulnerability of the Clojure programming language interpreter is related to the deserialization of unreliable data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...