org.apache.camel:camel-cometd (>=2.9.0-rc1, <=2.9.0), org.apache.camel:camel-example-cxf (>=2.9.0-rc1, <=2.9.0) +109 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (7.5.3.v20111011)

org.eclipse.jetty:jetty-server MAVEN version 7.5.3.v20111011 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.camel:camel-cometd =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1,...

GHSA-H6RP-8V4J-HWPH Apache Camel's XSLT component allows remote attackers to execute arbitrary Java methods

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message...

org.apache.camel:camel-activemq (1.0.0), org.apache.camel:camel-bam (1.0.0) +18 more potentially affected by CVE-2014-0002 via org.apache.camel:camel-core (1.0.0)

org.apache.camel:camel-core MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel:camel-activemq 1.0.0 - org.apache.camel:camel-bam 1.0.0 - org.apache.camel:camel-cxf 1.0...

com.bluelock:camel-spring-amqp (>=1.0, <=1.6.3), com.catify.bpmn:bpmn-engine-dist-jpa-camel (1.1) +452 more potentially affected by CVE-2014-0002 via org.apache.camel:camel-core (>=2.0-m1, <=2.11.3)

org.apache.camel:camel-core MAVEN version =2.0-m1, =1.0, =0.3.4, =0.4.0 - com.github.lewissk:hornetq-component 0.1 - com.github.microon:microon-services-calendar 0.0 - com.github.rmannibucau:camel-loader 0.0.1 and more Source cves: CVE-2014-0002 Source advisory: GHSA-2FW5-RVF2-JQ56...

Apache Camel's XSLT component allows remote attackers to read arbitrary files

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External...

GHSA-2FW5-RVF2-JQ56 Apache Camel's XSLT component allows remote attackers to read arbitrary files

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External...

org.apache.camel:camel-activemq (1.0.0), org.apache.camel:camel-bam (1.0.0) +18 more potentially affected by CVE-2017-5643 via org.apache.camel:camel-core (1.0.0)

org.apache.camel:camel-core MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel:camel-activemq 1.0.0 - org.apache.camel:camel-bam 1.0.0 - org.apache.camel:camel-cxf 1.0...

org.apache.activemq.tooling:maven-activemq-memtest-plugin (5.2.0), org.apache.activemq.tooling:maven-activemq-perf-plugin (5.2.0) +97 more potentially affected by CVE-2017-5643 via org.apache.camel:camel-core (1.5.0)

org.apache.camel:camel-core MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.activemq.tooling:maven-activemq-memtest-plugin 5.2.0 -...

org.apache.camel:camel-amqp (1.6.0), org.apache.camel:camel-atom (1.6.0) +67 more potentially affected by CVE-2017-5643 via org.apache.camel:camel-core (1.6.0)

org.apache.camel:camel-core MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel:camel-amqp 1.6.0 - org.apache.camel:camel-atom 1.6.0 - org.apache.camel:camel-bam 1.6.0 ...

org.apache.camel:camel-amqp (1.6.1), org.apache.camel:camel-atom (1.6.1) +60 more potentially affected by CVE-2017-5643 via org.apache.camel:camel-core (1.6.1)

org.apache.camel:camel-core MAVEN version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel:camel-amqp 1.6.1 - org.apache.camel:camel-atom 1.6.1 - org.apache.camel:camel-bam 1.6.1 ...

org.apache.camel:camel-amqp (1.6.2), org.apache.camel:camel-atom (1.6.2) +59 more potentially affected by CVE-2017-5643 via org.apache.camel:camel-core (1.6.2)

org.apache.camel:camel-core MAVEN version 1.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel:camel-amqp 1.6.2 - org.apache.camel:camel-atom 1.6.2 - org.apache.camel:camel-bam 1.6.2 ...

org.apache.camel:camel-amqp (1.6.4), org.apache.camel:camel-atom (1.6.4) +58 more potentially affected by CVE-2017-5643 via org.apache.camel:camel-core (1.6.4)

org.apache.camel:camel-core MAVEN version 1.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel:camel-amqp 1.6.4 - org.apache.camel:camel-atom 1.6.4 - org.apache.camel:camel-bam 1.6.4 ...

GHSA-VQ9J-JH62-5HMP Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

Description: The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can use this feature to make Server-Side Request Forgery SSRF attacks by sending XML documents with remote DTDs URLs or XM...

Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

Description: The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can use this feature to make Server-Side Request Forgery SSRF attacks by sending XML documents with remote DTDs URLs or XM...

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks

Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows to specify such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in various...

GHSA-VVJC-Q5VR-52Q6 Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks

Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows to specify such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in various...

org.apache.camel:camel-atmosphere-websocket (2.16.0), org.apache.camel:camel-example-cxf-tomcat (2.16.0) +8 more potentially affected by CVE-2015-5348 via org.apache.camel:camel-servlet (2.16.0)

org.apache.camel:camel-servlet MAVEN version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-servlet and may be impacted: - org.apache.camel:camel-atmosphere-websocket 2.16.0 - org.apache.camel:camel-example-cxf-tomcat...

org.apache.camel:camel-atmosphere-websocket (2.16.0), org.apache.camel:camel-example-cxf-tomcat (2.16.0) +8 more potentially affected by CVE-2015-5348 via org.apache.camel:camel-servlet (2.16.0)

org.apache.camel:camel-servlet MAVEN version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-servlet and may be impacted: - org.apache.camel:camel-atmosphere-websocket 2.16.0 - org.apache.camel:camel-example-cxf-tomcat...

org.apache.camel:camel-atmosphere-websocket (2.16.0), org.apache.camel:camel-example-cxf (2.16.0) +19 more potentially affected by CVE-2015-5348 via org.apache.camel:camel-http-common (2.16.0)

org.apache.camel:camel-http-common MAVEN version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-http-common and may be impacted: - org.apache.camel:camel-atmosphere-websocket 2.16.0 - org.apache.camel:camel-example-cxf...

GHSA-26V6-W6FW-RH94 Apache Camel can allow remote attackers to execute arbitrary commands

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...