267 matches found
CVE-2020-15824
In JetBrains Kotlin from 1.4-M1 to 1.4-RC as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0 there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default...
GHSA-J3RH-8VWQ-WH84 JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0
JHipster Kotlin is using an insecure source of randomness to generate all of its random values. JHipster Kotlin relies upon apache commons lang3 RandomStringUtils. From the documentation: Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically...
JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0
JHipster Kotlin is using an insecure source of randomness to generate all of its random values. JHipster Kotlin relies upon apache commons lang3 RandomStringUtils. From the documentation: Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically...
CVE-2020-4072
In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem...
CVE-2020-4072 Log Forging in generator-jhipster-kotlin
In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem...
CVE-2020-4072
CVE-2020-4072 affects generator-jhipster-kotlin 1.6.0. It allows log forging by creating log entries for invalid password reset attempts using a user-provided email; the issue arises in applications generated with JWT or session authentication (OAuth apps are not affected). The root cause is logg...
Log Forging in generator-jhipster-kotlin
Impact We log the mail for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt...
Cryptographically Weak PRNG
Overview All versions of generator-jhipster-kotlin use a Cryptographically Weak PRNG that may lead to account takeover. The package uses a cryptographically insecure method to generate password reset links, which allows an attacker to guess password reset links and takeover accounts. Recommendati...
CVE-2019-16303
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness apache.commons.lang3 RandomStringUtils. This allows an attacker if able to obtain their own password reset URL to compute the value for all other...
CVE-2019-16303
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness apache.commons.lang3 RandomStringUtils. This allows an attacker if able to obtain their own password reset URL to compute the value for all other...
Default credentials
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness apache.commons.lang3 RandomStringUtils. This allows an attacker if able to obtain their own password reset URL to compute the value for all other...
CVE-2019-16303
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness apache.commons.lang3 RandomStringUtils. This allows an attacker if able to obtain their own password reset URL to compute the value for all other...
CVE-2019-16303
CVE-2019-16303 affects JHipster-generated apps: a class produced by the Generator (before 6.3.0) and JHipster Kotlin (through 1.1.0) uses an insecure RNG (apache.commons.lang3 RandomStringUtils) to create password reset tokens. This can enable an attacker who obtains their own password reset URL ...
PT-2019-14615 · Jhipster +1 · Jhipster Kotlin +2
Name of the Vulnerable Software and Affected Versions: JHipster versions prior to 6.3.0 JHipster Kotlin versions prior to 1.2.0 Description: A vulnerability exists due to the use of an insecure source of randomness, specifically apache.commons.lang3 RandomStringUtils, which allows an attacker to...
JetBrains Kotlin Man-in-the-Middle Attack Vulnerability
JetBrains Kotlin is a statically typed programming language from the Czech company JetBrains that runs on the Java Virtual Machine. A man-in-the-middle attack vulnerability exists in JetBrains Kotlin versions prior to 1.3.30. An attacker could exploit this vulnerability to conduct a...
JetBrains TeamCity Encryption Security Vulnerability
JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. An encryption issue vulnerability exists in...
CVE-2019-10103
JetBrains IntelliJ IDEA projects created using the Kotlin JS Client/JVM Server IDE Template were resolving Gradle artifacts using an http connection, potentially allowing an MITM attack. This issue, which was fixed in Kotlin plugin version 1.3.30, is similar to CVE-2019-10101...
CVE-2019-10102
JetBrains Ktor framework created using the Kotlin IDE template versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. This issue was fixed in Kotlin plugin version 1.3.30...