GHSA-R346-RMRG-QPGH Improper Neutralization of Input During Web Page Generation in RESTEasy

Cross-site scripting XSS vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Improper Neutralization of Input During Web Page Generation in RESTEasy

Cross-site scripting XSS vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

GHSA-G4JG-GPWV-P7WV Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding JAXB input, aka an XML external entity XXE injection attack, a similar vulnerability to...

Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding JAXB input, aka an XML external entity XXE injection attack, a similar vulnerability to...

GHSA-WRRH-G7H3-GQMX Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity XXE injection attack...

Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity XXE injection attack...

JBoss RESTEasy vulnerable to Improper Input Validation

JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions...

GHSA-HGJR-XWJ3-JFVW JBoss RESTEasy vulnerable to Improper Input Validation

JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions...

GHSA-QJPQ-5PQ3-43RR Incorrect Privilege Assignment in RESTEasy

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform EAP 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and hav...

Incorrect Privilege Assignment in RESTEasy

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform EAP 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and hav...

GHSA-WXVR-VQFP-9CQW Denial of service in JBoss resteasy

RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors...

Denial of service in JBoss resteasy

RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors...

Deserialization of Untrusted Data in org.jboss.resteasy:resteasy-yaml-provider

It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via Yaml.load in YamlProvider. Mitigation: If the YamlProvider is enabled it's recommended to add authentication, and authorization to the endpoint expectin...

The vulnerability of the RESTEasy software lies in the lack of protection for operational data, which allows attackers to disclose sensitive information that should be protected.

The vulnerability of the RESTEasy software is related to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to disclose the protected information remotely...

Cross-Site Scripting (XSS)

resteasy is vulnerable to cross-site scripting. The vulnerability exists because the encoding is not properly handled which allows an attacker to inject and execute arbitrary javascript...

resteasy: Error message exposes endpoint class information

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.5.10 update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For...

Privilege Escalation

io.quarkus.resteasy.reactive:resteasy-reactive-vertx is vulnerable to privilege escalation. A low-privileged attacker is able to perform unauthorized operations on the database due to a permissions leak on web requests, which allows the attacker to elevate privileges...

CVE-2022-0981

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

CVE-2022-0981

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...