CVE-2021-41411

drools =7.59.x is affected by an XML External Entity XXE vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability...

drools 代码问题漏洞

drools is KIE open source a business rules management system . Open source rules engine, DMN engine and Complex Event Processing CEP engine for Java and JVM platforms. A security vulnerability exists in drools 7.59.x and earlier versions , the vulnerability stems from the Validator class in...

PT-2022-11391 · Drools +1 · Drools +1

Name of the Vulnerable Software and Affected Versions: drools versions prior to 7.60 Description: The issue is related to an XML External Entity XXE vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability. Recommendations:...

org.apache.camel:camel-jbpm (>=2.23.0 <=3.0.0-M2), org.apache.camel:camel-jbpm-starter (>=2.23.0 <=3.0.0-M2) +113 more potentially affected by CVE-2016-7043 via org.kie.server:kie-server-common (>=7.0.0.Beta3 <=7.20.0.Final)

org.kie.server:kie-server-common MAVEN version =7.0.0.Beta3, =2.23.0, =2.23.0, =7.14.0.Final, =7.16.0.Final, =7.10.0.Final, =7.10.0.Final, =7.0.0.Beta3, =7.0.0.Beta3, =7.0.0.Beta3, =7.0.0.Beta3, =7.0.0.Beta3, =7.0.0.Beta3, =7.0.0.Beta5 and more Source cves: CVE-2016-7043 Source advisory:...

GHSA-QVQ6-CW53-RMWG Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP

The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted...

Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP

The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted...

Improper Input Validation in Drools and jBPM

XML external entity XXE vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file...

Security Bulletin: XXE Vulnerability in Drools Affects IBM Sterling B2B Integrator (CVE-2014-8125)

Summary IBM Sterling B2B Integrator has addressed the security vulnerability. Vulnerability Details CVEID: CVE-2014-8125 DESCRIPTION: Drools and jBPM could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error within the jBPM runtime. By...

CVE-2021-27602

SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the...

CVE-2021-27602

SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the...

Remote code execution

SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the...

CVE-2021-27602

CVE-2021-27602 affects SAP Commerce Backoffice in versions 1808, 1811, 1905, 2005, 2011. The backoffice allows certain authorized users to create source rules, which are translated to Drools rules when published to certain modules. The vulnerability arises when an attacker with this authorization...

SAP Commerce Critical Security Bug Allows RCE

SAP is warning of a critical vulnerability in its SAP Commerce platform for e-commerce businesses. If exploited, the flaw could allow for remote code execution RCE that ultimately could compromise or disrupt the application. SAP Commerce organizes data – such as product information – to be...

CVE-2021-21477

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability...

CVE-2021-21477

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability...

Remote code execution

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability...

CVE-2021-21477

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability...

SUSE-RU-2019:1006-1 Security update for SUSE Manager Server 3.2

This update includes the following new features: to the repository metadata fate325676 This update fixes the following issues: apache-commons-lang3: - Run fdupes on javadoc - Specify java target and source level 1.6 to make package compatible with JDK = 1.8 cobbler: - Fixes case where distributio...

CVE-2016-7041

Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host...

Path traversal

Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host...