CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

lazylist-cve-poc

CVE-2022-36944 ペイロードジェネレーター このミニプロジェクトは、CVE-2022-36944 脆弱性の概念実証を示すために作成されました。ysoserial に似ていますが、LazyList クラスを使用してこの CVE 専用のペイロードのみを生成します。 クイックFAQ 脆弱性をもたらすアーティファクトは何ですか？ 2.13.9 より前のバージョン 2.13.x の org.scala-lang:scala-library 影響を受けるアプリケーションは？ アプリケーションが悪用可能になるには、次の2つの条件が揃っている必要があります： アプリケーションのクラスパスに脆...

ROOT-APP-MAVEN-CVE-2022-36944 CVE-2022-36944 in io.root.org.scala-lang:scala-library - Patched by Root

Root has patched CVE-2022-36944 in the io.root.org.scala-lang:scala-library package for Root:Maven. Multiple fixed versions available...

Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8

Summary Third party reported 'Stored XSS' and 'CSRF' issues, Apache Tomcat, Apache ActiveMQ, CKEditor, libcURL, xmlbeans, scala-library, json-smart, jna-platform, jackson-databind, commons-io, shiro-core, commons-net, snappy-java, xercesImpl are identified as vulnerable components with multiple...

Deserialization Of Untrusted Data

scala-library is vulnerable to deserialization of untrusted data. The vulnerability exists because the readObject function in the LazyList.scala allows an attacker to erase the contents of arbitrary files, make network connections, or possibly run arbitrary code on Function0 via a gadget chain...

CVE-2021-21293

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

Design/Logic Flaw

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...