CVE-2021-21293

CVE-2021-21293 concerns blaze-core prior to 0.14.15, where unbounded acceptance of new connections on a dedicated thread pool can exhaust file handles and degrade services. Affected component is blaze-core (used by http4s-blaze-server) with unbounded queues after accept. The fix in 0.14.15 adds a...

Exploit for Path Traversal in Apache Flink

CVE-2020-17518 Apache Flink RESTful API Arbitrary File Upload...

Apache Flink suffers from an arbitrary file read vulnerability

Apache Flink is an open source distributed streaming data processing engine from the Apache Software Foundation. It is written primarily in Java and Scala languages. Apache Flink has an arbitrary file read vulnerability that can be exploited by an attacker to obtain sensitive information...

GHSA-QV8Q-V995-72GR personnummer/csharp vulnerable to Improper Input Validation

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severity. Impact This vulnerability impacts...

JetBrains Scala Plugin Encryption Issue Vulnerability

JetBrains Scala plugin is a language plugin from the Czech company JetBrains. A vulnerability with cryptographic issues exists in versions of JetBrains Scala plugin prior to 2019.2.1. An attacker can exploit the vulnerability to obtain sensitive information by sniffing network traffic...

CVE-2020-7907

In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections...

CVE-2020-7907

In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections...

Design/Logic Flaw

In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections...

CVE-2020-7907

The CVE-2020-7907 issue affects the JetBrains Scala plugin prior to 2019.2.1, where artifact dependencies were resolved over unencrypted HTTP connections. This could allow an attacker to sniff network traffic and potentially obtain sensitive information. The vulnerability was addressed in 2019.2....

CVE-2020-7907

In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections...

JetBrains Security Bulletin Q4 2019

FYI Security JetBrains Security Bulletin Q4 2019 Robert Demmer In the fourth quarter of 2019, we resolved a series of security issues in our products. Here’s a summary report that contains a description of each issue and the version in which it was resolved. Product | Description | Severity |...

Unsafe Dependency Resolution

Overview com.fasterxml.jackson.module:jackson-module-scala is an Add-on module for Jackson http://wiki.fasterxml.com/JacksonHome to support Scala-specific datatypes. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure...

Downloads Resources over HTTP in scala-bin

Affected versions of scala-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syst...

GHSA-3VV5-42WR-M32G Downloads Resources over HTTP in scala-bin

Affected versions of scala-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syst...

GLSA-201812-08 : Scala: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-201812-08 Scala: Privilege escalation It was discovered that Scalas compilation daemon does not properly manage permissions for private files. Impact : A local attacker could escalate privileges. Workaround : There is no known...

Scala: Privilege escalation

Background Scala combines object-oriented and functional programming in one concise, high-level language. Description It was discovered that Scala’s compilation daemon does not properly manage permissions for private files. Impact A local attacker could escalate privileges. Workaround There is no...

Signature Verification Bypass

jwt-scala is vulnerable to a signature verification bypass. A malicious user can pass a token that declares the cipher type to be NONE or any HS cipher type in the header to the system, passing it off as a correctly signed token...

High severity vulnerability that affects org.scala-lang:scala-compiler

The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/$USER:shared/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges...

GHSA-QVXV-PMQ9-4Q7G High severity vulnerability that affects org.scala-lang:scala-compiler

The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/$USER:shared/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges...

CVE-2016-10634

scala-standalone-bin is a Binary wrapper for ScalaJS. scala-standalone-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacke...