Apache jUDDI 代码问题漏洞

Apache jUDDI is a java implementation of UDDI open source package that serves WebServices. jUDDI versions prior to Apache jUDDI 3.3.10 have a code issue vulnerability that can be exploited by attackers to remotely run arbitrary code...

CVE-2021-37578: Deserialization of Untrusted Data

Apache jUDDI uses several classes related to Java's Remote Method Invocation RMI which as an extension to UDDI provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicio...

PT-2021-4021

Name of the Vulnerable Software and Affected Versions Apache jUDDI versions prior to 3.3.10 Description The issue is related to the use of Java's Remote Method Invocation RMI in Apache jUDDI, which provides an alternate transport for accessing UDDI services. RMI uses the default Java serializatio...

org.apache.juddi:juddi-tomcat (>=3.3.6, <=3.3.7), org.apache.juddi:uddi-tck (>=3.3.6, <=3.3.7) +9 more potentially affected by CVE-2020-1935 via org.apache.tomcat:tomcat (>=9.0.10, <=9.0.30)

org.apache.tomcat:tomcat MAVEN version =9.0.10, =3.3.6, =3.3.6, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =5.22.2, =5.23.5.1 Source cves: CVE-2020-1935 Source advisory: OSV:GHSA-QXF4-CHVG-4R8R...

org.apache.juddi:juddi-tomcat (3.3.6), org.apache.juddi:uddi-tck (3.3.6) +8 more potentially affected by CVE-2019-0221 via org.apache.tomcat:tomcat (>=9.0.10, <=9.0.12)

org.apache.tomcat:tomcat MAVEN version =9.0.10, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m2 Source cves: CVE-2019-0221 Source advisory: OSV:GHSA-JJPQ-GP5Q-8Q6W...

Log Spoofing

Apache jUDDI is vulnerable to log spoofing. An error with the logging of keys allow an attacker to spoof entries in the log files, such as creating a false entry for a non-existent action...

Apache juddi-client vulnerable to XML External Entity (XXE)

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use...

GHSA-P99P-726H-C8V5 Apache juddi-client vulnerable to XML External Entity (XXE)

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use...

GHSA-49H4-G8P5-JGQ6 Moderate severity vulnerability that affects org.apache.juddi:juddi-client

After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the browser to an unintended web page in Apache jUDDI 3.1.2, 3.1.3, 3.1.4, and 3.1.5 when utilizing the portlets based user interface also known as...

Moderate severity vulnerability that affects org.apache.juddi:juddi-client

After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the browser to an unintended web page in Apache jUDDI 3.1.2, 3.1.3, 3.1.4, and 3.1.5 when utilizing the portlets based user interface also known as...

Code injection

The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof log entries via the numRows parameter...

CVE-2009-4267

The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof log entries via the numRows parameter...

CVE-2009-4267

The CVE-2009-4267 entry concerns Apache jUDDI 3.0.0 where the console fails to properly escape line feeds, enabling remote authenticated users to spoof log entries via the numRows parameter. The NVD record notes an environmental risk with CVSS scores: CVSSv2 base 4.0 (Medium) and CVSSv3 base 6.5 ...

CVE-2009-4267

The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof log entries via the numRows parameter...

CVE-2009-4267: Improper Encoding or Escaping of Output

The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof log entries via the numRows parameter...

PT-2018-4020

Name of the Vulnerable Software and Affected Versions Apache jUDDI version 3.0.0 Description The issue concerns the console in Apache jUDDI, which fails to properly escape line feeds. This allows remote authenticated users to spoof log entries by manipulating the numRows parameter. Recommendation...

XML External Entities (XXE)

Apache jUDDI is vulnerable to XML External Entity expansion XXE attacks. The application does not disable Document Type Definition resolutions, allowing attackers to access sensitive information or conduct XXE attacks that can lead to a denial of service...

Apache jUDDI XML Entity Extension Attack Vulnerability

Apache jUDDI is the United States Apache Apache Software Foundation of a Java-based , open source follow the UDDI standard application . A security vulnerability exists in Apache jUDDI versions 3.2 through 3.3.4. An attacker can exploit the vulnerability to implement XML entity expansion and DTD...

CVE-2018-1307

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use...

CVE-2018-1307

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use...