Information Disclosure in Apache Groovy

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

GHSA-RCJJ-H6GH-JF3R Information Disclosure in Apache Groovy

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

ch.exense.step:step-automation-packages-client (>=3.24.1 <=3.29.5), ch.exense.step:step-automation-packages-controller (>=3.24.1 <=3.29.5) +433 more potentially affected by CVE-2020-17521 via org.codehaus.groovy:groovy-all (>=3.0.0 <=3.0.6)

org.codehaus.groovy:groovy-all MAVEN version =3.0.0, =3.24.1, =3.24.1, =3.24.1, =3.27.0, =3.27.0, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.26.0, =3.26.0, =3.22.0, =3.20.0, =3.20.0, =3.29.5 and more Source cves: CVE-2020-17521 Source advisory: OSV:GHSA-RCJJ-H6GH-JF3R...

app.ariadust.dendrobium:app.ariadust.dendrobium.gradle.plugin (>=1.0.0 <=1.0.4), aspectj.AspectjGradlePlugin:aspectj.AspectjGradlePlugin.gradle.plugin (>=0.0.2 <=0.0.3) +3232 more potentially affected by CVE-2020-17521 via org.codehaus.groovy:groovy-all (>=2.0.0 <=2.4.20)

org.codehaus.groovy:groovy-all MAVEN version =2.0.0, =1.0.0, =0.0.2, =0.2.DEV, =0.2.DEV, =2.1.10, =2.0.0, =2.0.0, =3.5.4-rc.0, =3.5.9, =3.5.9, =3.5.15, =3.5.15, =3.6.0-rc.1 - au.com.dius:pact-jvm-consumer-junit2.10 =2.4.20 and more Source cves: CVE-2020-17521 Source advisory: OSV:GHSA-RCJJ-H6GH-J...

0x.plugin.bom:zero-x-plugin-bom (>=0.0.10 <=1.1.0), app.ariadust.dendrobium:app.ariadust.dendrobium.gradle.plugin (>=1.0.0 <=1.0.4) +3620 more potentially affected by CVE-2020-17521 via org.codehaus.groovy:groovy (>=3.0.0 <=3.0.6)

org.codehaus.groovy:groovy MAVEN version =3.0.0, =0.0.10, =1.0.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.0.6, =4.1.0, =4.3.19 - au.com.dius:pact-jvm-consumer-groovy =4.0.6 and more Source cves: CVE-2020-17521 Source advisory: OSV:GHSA-RCJJ-H6GH-JF3R...

au.com.dius.pact.consumer:groovy (>=4.1.0 <=4.2.21), au.com.dius:pact-jvm-consumer-groovy (>=4.0.7 <=4.0.10) +843 more potentially affected by CVE-2020-17521 via org.codehaus.groovy:groovy (>=2.5.0 <=2.5.13)

org.codehaus.groovy:groovy MAVEN version =2.5.0, =4.1.0, =4.0.7, =2.2.1, =3.0.0, =0.9.0, =3.1.174, =8.1.0.371, =8.1.0.304, =8.1.0.371, =8.1.0.516, =8.1.0.304, =8.1.0.578.187 and more Source cves: CVE-2020-17521 Source advisory: OSV:GHSA-RCJJ-H6GH-JF3R...

CVE-2020-17521

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

DEBIAN-CVE-2020-17521

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

CVE-2020-17521

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

CVE-2020-17521

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

Code injection

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

UBUNTU-CVE-2020-17521

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

CVE-2020-17521

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

CVE-2020-17521

CVE-2020-17521 affects Apache Groovy extension methods that handle temporary directory creation. The root cause is a race condition in Groovy’s implementation, which previously called a now-superseded Java JDK method; this could allow a local attacker to obtain sensitive information. Affected ver...

CVE-2020-17521

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...

Apache Groovy 安全漏洞

Apache Groovy is the United States Apache Apache Software Foundation of a Java-based platform for object-oriented programming language, which combines many powerful features of Python, Ruby and Smalltalk. A resource management error vulnerability exists in the Apache Groovy provides product that...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

CVE-2020-9484 is a vulnerability in the Apache Tomcat web server. The vulnerability allows an attacker to execute arbitrary code on the server by exploiting a deserialization vulnerability in the Apache Commons Collections library, which is used by Tomcat. The exploit code is written in Groovy an...

Jenkins 2.63 Sandbox Bypass

Exploit Title: Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in Date: 8th October 2020 Exploit Author: dmw0ng Vendor Homepage: https://www.jenkins.io Software Link: http://archives.jenkins-ci.org/windows/jenkins-2.63.zip Version: Jenkins 2.63 Tested on: Ubuntu 18.04 / 20.04 CVE :...

Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in

Exploit Title: Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in Date: 8th October 2020 Exploit Author: dmw0ng Vendor Homepage: https://www.jenkins.io Software Link: http://archives.jenkins-ci.org/windows/jenkins-2.63.zip Version: Jenkins 2.63 Tested on: Ubuntu 18.04 / 20.04 CVE :...

Crafter CMS Dynamic Management Code Resource Miscontrol Vulnerability (CNVD-2020-63996)

Crafter CMS is an open source content management system for websites, mobile apps, VR and more. A Dynamic Management Code Resource Miscontrol vulnerability exists in Crafter Studio in Crafter CMS. An attacker can exploit this vulnerability to execute OS commands via Groovy scripts...