com.opensearchserver:oss-java-client (1.0.0), com.opensearchserver:oss-utils (1.0.0) +63 more potentially affected by CVE-2019-3888 via io.undertow:undertow-core (1.1.2.final)

io.undertow:undertow-core MAVEN version 1.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.opensearchserver:oss-java-client 1.0.0 - com.opensearchserver:oss-utils 1.0.0 -...

org.carewebframework:org.carewebframework.fhir.client (1.2), org.carewebframework:org.carewebframework.fhir.core (1.2) +2 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (1.2)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 1.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - org.carewebframework:org.carewebframework.fhir.client 1.2 -...

ca.uhn.hapi.fhir:hapi-fhir-android (1.3), org.carewebframework:org.carewebframework.fhir.client (1.3) +7 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (1.3)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 1.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 1.3 - org.carewebframework:org.carewebframework.fhir.client 1.3 ...

EulerOS Virtualization 3.0.1.0 : thrift (EulerOS-SA-2019-1458)

According to the versions of the thrift packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security...

Apache Thrift Java client library authorization issue vulnerability

Apache Thrift is the United States Apache Apache Software Foundation for cross-platform development framework. Java client library is one of the client library . An authorization issue vulnerability exists in the Apache Thrift Java client library versions 0.5.0 through 0.11.0, which can be...

CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

CVE-2018-1320

CVE-2018-1320 affects Apache Thrift: Java client library versions 0.5.0–0.11.0. The issue stems from an assert in TSaslTransport.isComplete that validates SASL handshakes; disabling this check can leave SASL negotiation validation incomplete, enabling a security bypass. Multiple connected sources...

CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

Input validation

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

DEBIAN-CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

UBUNTU-CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

CVE-2018-1320: Improper Certificate Validation

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

Man-in-the-Middle (MitM)

spring-rabbit is vulnerable to man-in-the-middle attacks. The Spring RabbitMQ Java client does not perform SSL hostname validation and accepts SSL certificates as long as they are trusted. This allows attackers to perform man-in-the-middle attacks between the RabbitMQ Java client and server...

CVE-2016-0750

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks...

Remote code execution

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks...

CVE-2016-0750

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks...

CVE-2016-0750

The CVE-2016-0750 issue affects the Infinispan project’s hotrod Java client prior to 9.1.0.Final, where bytearray message contents could be deserialized during certain events. A malicious attacker could inject a crafted serialized object to trigger deserialization on the client and potentially ac...