hibernate__hibernate-validator_CVE-2019-10219_6_0_18_Final_fixed

Hibernate Validator Version: 6.0.18.Final - 25-10-2019 What is it? This is the reference implementation of JSR-380 - Bean Validation 2.0. Bean Validation defines a metadata model and API for JavaBean as well as method validation. The default metadata source are annotations, with the ability to...

XWiki - HQL Injection

XWiki is vulnerable to Hibernate Query Language HQL injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potential...

hibernate__hibernate-validator_CVE-2019-10219_6-0-17-Final

Hibernate Validator Version: 6.0.17.Final - 13-06-2019 What is it? This is the reference implementation of JSR-380 - Bean Validation 2.0. Bean Validation defines a metadata model and API for JavaBean as well as method validation. The default metadata source are annotations, with the ability to...

hibernate-orm

Hibernate ORM is a library providing Object/Relational Mapping ORM support to applications, libraries, and frameworks. It also provides an implementation of the JPA specification, which is the standard Java specification for ORM. This is the repository of its source code: see Hibernate.org for...

cve-2021-44228--spring-hibernate

CVE-2021-44228 POC - Spring / Hibernate This POC uses Spring / Hibernate, however a similar approach of rmi - deserialization could be used to trigger any deserialization vulnerability TL;DR $ docker-compose up $ curl -X POST -H 'Content-Type: text/plain' localhost:8080 --data-binary...

CVE-2026-0603

CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injection ★ CVE-2026-0603 Hibernate SQL Injection PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Overview CVE-2026-0603 is a Second-Order SQL Injection vulnerability in Hibernate ORM , a widely used Ja...

CVE-2026-0603

CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injection ★ CVE-2026-0603 Hibernate SQL Injection PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Overview CVE-2026-0603 is a Second-Order SQL Injection vulnerability in Hibernate ORM , a widely used Ja...

Security Bulletin: IBM WebSphere Application Server Liberty, bundled with IBM WebSphere Hybrid Edition, is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by multiple vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...

DEBIAN-CVE-2026-93879

Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language EL expressions...

CVE-2026-93879

Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language EL expressions...

CVE-2026-93879 Hibernate Validator is affected by an expression language injection vulnerability

Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language EL expressions...

CVE-2026-93879 Hibernate Validator is affected by an expression language injection vulnerability

Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language EL expressions...

CVE-2026-93879

The Hibernate Validator library is vulnerable to a Denial of Service (DoS) attack due to uncontrolled resource consumption. The root cause is the improper escaping of user-controlled data within Expression Language (EL) expressions. This vulnerability impacts several products, including IBM WebSp...

IBM Hibernate Validator resource management error vulnerability

Versions 5.4.1.Final through 6.2.5.Final, 7.0.0.Alpha1 through 7.0.5.Final, 8.0.0.Alpha1 through 8.0.5.Final, 9.0.0.Beta2 through 9.0.1.Final, and 9.1.0.Alpha1 through 9.1.4.Final of IBM Hibernate Validator contain a resource management error vulnerability. This vulnerability stems from improper...

org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass

A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the...

org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass

A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: mask DAIF before restoring hibernated kernel The arm64 hibernate code manages exception masking in an improper manner, potentially leading to crashes or warnings during resume. When a hibernation image is saved ...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by an Uncontrolled Resource Consumption vulnerability due to Hibernate Validator 9.1.3.Final (CVE-2026-93879)

Summary There is a vulnerability in the Hibernate Validator 9.1.3.Final library that affects IBM WebSphere Application Server Liberty with the beanValidation-2.0, beanValidation-3.0 or validation-3.1 feature enabled. Vulnerability Details CVEID:CVE-2026-93879 DESCRIPTION: Hibernate Validator coul...

CVE-2026-120200

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints ...

CVE-2026-120200

Nexterm versions through 1.2.2-BETA are vulnerable to a missing authorization flaw in the server session lifecycle routes. This vulnerability allows an authenticated attacker who obtains a session ID to call the hibernate , resume , or DELETE connection endpoints. Consequently, an attacker can di...