HTTP Header Injection

stanford-corenlp is vulnerable to HTTP header injection. The addResults function of NERServlet.java does not properly validate the data in an HTTP response, allowing an attacker to inject malicious headers in requests...

Improper access control

An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java lines 158 and 159...

CVE-2021-44550

An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java lines 158 and 159...

CVE-2021-44550

CVE-2021-44550 corresponds to an Incorrect Access Control vulnerability in Stanford CoreNLP 4.3.2, exposed via the NERServlet classifier. The issue enables HTTP header injection by not properly validating or escaping the classifier header, allowing a remote attacker to craft requests that inject ...

PT-2022-12160

Name of the Vulnerable Software and Affected Versions CoreNLP version 4.3.2 Description An issue exists due to incorrect access control in the classifier within NERServlet.java, specifically at lines 158 and 159. Recommendations For CoreNLP version 4.3.2, consider restricting access to the...

CVE-2021-44550: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java lines 158 and 159...