Cross-site Scripting (XSS)

quarkus-vertx-http is vulnerable to Cross-site Scripting XSS. The vulnerability exists because the library's form authentication session cookie path attribute is set to /, which allows an attacker to redirect malicious URLs, resulting in information disclosure...

Path Traversal

vertx-web is vulnerable to Path Traversal. The vulnerability exists in the pathOffset function of Utils.java When running vertx web applications that serve files using the StaticHandler on Windows Operating Systems and Windows File Systems. If the mount point is a wildcard , then an attacker can...

StaticHandler disclosure of classpath resources on Windows when mounted on a wildcard route

Summary When running vertx web applications that serve files using StaticHandler on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard then an attacker can exfiltrate any class path resource. Details When computing the relative path to locate the resource, in cas...

CVE-2023-24815 Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web

Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using StaticHandler on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard then an attacker can exfiltrate a...

Eclipse Vertx-web 路径遍历漏洞

Eclipse Vertx-web is an Eclipse Foundation framework for building web applications. A path traversal vulnerability exists in Eclipse Vertx-web versions prior to 4.3.8, which stems from the fact that an attacker can disclose any class path resource if the mount point is a wildcard...

Red Hat quarkus-vertx-http 跨站脚本漏洞

Red Hat quarkus-vertx-http is a toolkit for building reactive applications from Red Hat USA. A security vulnerability exists in Red Hat quarkus-vertx-http. An attacker could exploit the vulnerability to perform a cross-site scripting attack, which could lead to information disclosure...

Remote Code Execution (RCE)

quarkus-vertx-http is vulnerable to remote code execution. The vulnerability exists in multiple functions due to drive-by localhost attacks which allows an attacker to inject and execute malicious query parameters via the Dev UI Config Editor...

Quarkus 安全漏洞

Quarkus is a cloud-native Linux container-first framework for writing Java applications. A security vulnerability exists in Quarkus quarkus-vertx-http, no information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...

@soutech/ali-jssdk (>=0.1.0, <=0.1.3), kr-ui-temp (1.0.24) potentially affected by unknown CVE via vertx (0.0.1-security)

vertx NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on vertx and may be impacted: - @soutech/ali-jssdk =0.1.0, =0.1.3 - kr-ui-temp 1.0.24 Source cves: unknown CVE Source advisory: OSV:MAL-2022-6907...

MAL-2022-6907 Malicious code in vertx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbd2800877ba20579d3320e441a617dd9097847830f6ddec3000486b98011f73 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vertx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbd2800877ba20579d3320e441a617dd9097847830f6ddec3000486b98011f73 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Privilege Escalation

io.quarkus.resteasy.reactive:resteasy-reactive-vertx is vulnerable to privilege escalation. A low-privileged attacker is able to perform unauthorized operations on the database due to a permissions leak on web requests, which allows the attacker to elevate privileges...

GHSA-VJW7-6GFQ-6WF5 Path Traversal in Eclipse Vert

In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0-milestone1, 4.0.0-milestone2, 4.0.0-milestone3, 4.0.0-milestone4, 4.0.0-milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the...

Heap overflow

Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prio...

CVE-2021-21369 Potential DoS in Besu HTTP JSON-RPC API

Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prio...

Eclipse Vertx-web Cross-Site Request Forgery Vulnerability

Eclipse Vertx-web is an Eclipse Foundation framework for building Web applications . A cross-site request forgery vulnerability exists in the Vert.x-Web framework v4.0 milestone 1-4, where the source program fails to perform proper CSRF validation. Instead of comparing the CSRF token in the reque...

Cross-Site Request Forgery (CSRF)

vertx-web is vulnerable to cross-site request forgery CSRF. The CSRF token provided by the framework is being sent as a HTTP session token and is not adequate to prevent CSRF attacks as the token is automatically included in every HTTP request...

Eclipse Vertx-web 跨站请求伪造漏洞

Eclipse Vertx-web is an Eclipse Foundation framework for building Web applications . A cross-site request forgery vulnerability exists in the Vert.x-Web framework v4.0 milestone 1-4, where the source program fails to perform proper CSRF validation. Instead of comparing the CSRF token in the reque...

Important: Red Hat Security Advisory: Red Hat Fuse 7.7.0 release and security update

A minor version update from 7.6 to 7.7 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

Important: Red Hat Security Advisory: Red Hat Fuse 7.2 security update

An update is now available for Red Hat Fuse. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...