763 matches found
GHSA-XRH2-C3RM-35JR HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference
HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy...
quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus
A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...
new packages: resteasy
An update is available for resteasy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.0...
XML External Entity Reference in RESTEasy
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the 1 external-general-entities or 2 external-parameter-entities features, which allows remote attackers to conduct XML external entity XXE attacks via unspecified vectors...
GHSA-PC54-PCHM-XCW6 XML External Entity Reference in RESTEasy
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the 1 external-general-entities or 2 external-parameter-entities features, which allows remote attackers to conduct XML external entity XXE attacks via unspecified vectors...
GHSA-VXHJ-3X7P-JXP5 Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...
GHSA-9XFC-J5MF-9W5P JacksonJsonpInterceptor susceptible to cross-site script inclusion (XSSI) attack
JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion XSSI attack...
JacksonJsonpInterceptor susceptible to cross-site script inclusion (XSSI) attack
JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion XSSI attack...
Improper Neutralization of Input During Web Page Generation in RESTEasy
Cross-site scripting XSS vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
GHSA-R346-RMRG-QPGH Improper Neutralization of Input During Web Page Generation in RESTEasy
Cross-site scripting XSS vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
GHSA-G4JG-GPWV-P7WV Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding JAXB input, aka an XML external entity XXE injection attack, a similar vulnerability to...
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding JAXB input, aka an XML external entity XXE injection attack, a similar vulnerability to...
GHSA-WRRH-G7H3-GQMX Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity XXE injection attack...
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity XXE injection attack...
JBoss RESTEasy vulnerable to Improper Input Validation
JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions...
GHSA-HGJR-XWJ3-JFVW JBoss RESTEasy vulnerable to Improper Input Validation
JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions...
GHSA-QJPQ-5PQ3-43RR Incorrect Privilege Assignment in RESTEasy
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform EAP 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and hav...
Incorrect Privilege Assignment in RESTEasy
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform EAP 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and hav...