CVE-2014-3626

The CVE-2014-3626 vulnerability affects the Grails Resource Plugin (pre-1.2.13). A directory-traversal protection bug caused the plugin to return the decoded URI after the traversal check instead of the normalized URI, enabling a double-decoding issue. The fixed behavior repeatedly decodes the UR...

CVE-2014-3626

The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did no...

PT-2018-4215

Name of the Vulnerable Software and Affected Versions Grails Resource Plugin versions prior to 1.2.13 Description A double decoding vulnerability exists due to a bug where the Grails Resource Plugin returns the decoded version of the URI rather than the normalized version after the directory...

CVE-2014-3626: Improper Limitation of a Pathname to a Restricted Directory

The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did no...

Grails PDF Plugin XML External Entity Information Disclosure Vulnerability

Grails PDF Plugin XML External Entity Information Disclosure vulnerability. An attacker can exploit the vulnerability to obtain sensitive information, which could lead to further attacks...

CVE-2017-6344

XML External Entity XXE vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document...

Xxe

XML External Entity XXE vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document...

CVE-2017-6344

XML External Entity XXE vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document...

CVE-2017-6344

XML External Entity XXE vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document...

CVE-2017-6344

CVE-2017-6344 describes an XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 that allows an attacker to read arbitrary files by submitting a crafted XML document. The issue arises from XXE in the plugin’s XML processing. Public references (NVD entry and CNVD/PRION/CVE landings) con...

CVE-2017-6344: Improper Restriction of XML External Entity Reference

XML External Entity XXE vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document...

PT-2017-17011

Name of the Vulnerable Software and Affected Versions Grails PDF Plugin version 0.6 Description The issue allows remote attackers to read arbitrary files via a crafted XML document, exploiting an XML External Entity XXE vulnerability. Recommendations For Grails PDF Plugin version 0.6, update to a...

Grails PDF Plugin 0.6 - XML External Entity Injection

Grails PDF Plugin 0.6 - XML External Entity Injection Exploit Title: Grails PDF Plugin 0.6 XXE Date: 21/02/2017 Vendor Homepage: http://www.grails.org/plugin/pdf Software Link: https://github.com/aeischeid/grails-pdfplugin Exploit Author: Charles FOL Contact: https://twitter.com/ambionics Website...

Grails PDF Plugin 0.6 - XML External Entity Injection

Exploit Title: Grails PDF Plugin 0.6 XXE Date: 21/02/2017 Vendor Homepage: http://www.grails.org/plugin/pdf Software Link: https://github.com/aeischeid/grails-pdfplugin Exploit Author: Charles FOL Contact: https://twitter.com/ambionics Website: https://www.ambionics.io/blog/grails-pdf-plugin-xxe...

CVE-2016-6521

Cross-site request forgery CSRF vulnerability in Grails console aka Grails Debug Console and Grails Web Console 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors...

CVE-2016-6521

Cross-site request forgery CSRF vulnerability in Grails console aka Grails Debug Console and Grails Web Console 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Grails console aka Grails Debug Console and Grails Web Console 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors...

CVE-2016-6521

CVE-2016-6521: CSRF vulnerability in Grails console (Grails Debug Console / Grails Web Console) versions 2.0.7, 1.5.10 and earlier. It allows remote attackers to hijack user authentication for requests that execute arbitrary Groovy code via unspecified vectors. Affected products/versions are name...

CVE-2016-6521

Cross-site request forgery CSRF vulnerability in Grails console aka Grails Debug Console and Grails Web Console 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors...

CVE-2016-6521: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Grails console aka Grails Debug Console and Grails Web Console 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors...