116 matches found
CVE-2020-1963
Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem...
CVE-2020-1963
Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem...
Design/Logic Flaw
Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem...
CVE-2020-1963
Apache Ignite (which uses H2 for its distributed SQL execution) has a vulnerability where H2 SQL functions could be abused to access the filesystem. The connected advisories corroborate that this vulnerability involves file-system access via H2 within Ignite. No exploit specifics, affected versio...
CVE-2020-1963
Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem...
CVE-2020-1963
Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem...
PT-2020-15196
Name of the Vulnerable Software and Affected Versions Apache Ignite affected versions not specified Description The issue concerns Apache Ignite's use of the H2 database to build a SQL distributed execution engine. H2 provides SQL functions that could potentially be used by an attacker to access...
CVE-2020-1963: Missing Authorization
Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem...
apache-ignite-users.70518.x6.nabble.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1181838 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
CVE-2018-8018
In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be...
Code execution via deserialization in org.apache.ignite:ignite-core
Apache Ignite 2.5 and earlier serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a...
org.apache.ignite:ignite-aop (1.0.0-rc1), org.apache.ignite:ignite-aws (1.0.0-rc1) +22 more potentially affected by CVE-2018-8018 via org.apache.ignite:ignite-core (1.0.0-rc1)
org.apache.ignite:ignite-core MAVEN version 1.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.0.0-rc1 - org.apache.ignite:ignite-aws 1.0.0-rc1 -...
com.ecfront.dew:cluster-spi-ignite (>=1.0.0, <=1.1.4), com.fnklabs.draenei:ignite (0.8.5) +47 more potentially affected by CVE-2018-8018 via org.apache.ignite:ignite-core (1.9.0)
org.apache.ignite:ignite-core MAVEN version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - com.ecfront.dew:cluster-spi-ignite =1.0.0, =2.0.7-release, =3.4.0, =3.4.0, =2.19.0, =2.19.0, =2.19.5 ...
org.apache.ignite:ignite-aop (1.5.0-b1), org.apache.ignite:ignite-aws (1.5.0-b1) +31 more potentially affected by CVE-2018-8018 via org.apache.ignite:ignite-core (1.5.0-b1)
org.apache.ignite:ignite-core MAVEN version 1.5.0-b1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.5.0-b1 - org.apache.ignite:ignite-aws 1.5.0-b1 -...
com.ecfront:ezf-message (>=3.0.0-beta1, <=3.0.0-beta3), com.jiuxian:mossrose (>=1.1.0-release, <=1.3.2-release) +46 more potentially affected by CVE-2018-8018 via org.apache.ignite:ignite-core (1.5.0.final)
org.apache.ignite:ignite-core MAVEN version 1.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - com.ecfront:ezf-message =3.0.0-beta1, =1.1.0-release, =1.0.0-release, =0.0.5, =0.18.0-rc1,...
GHSA-QCJV-WFCG-MMPR Code execution via deserialization in org.apache.ignite:ignite-core
Apache Ignite 2.5 and earlier serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a...
org.apache.ignite:ignite-aop (1.1.0-incubating), org.apache.ignite:ignite-aws (1.1.0-incubating) +22 more potentially affected by CVE-2018-8018 via org.apache.ignite:ignite-core (1.1.0-incubating)
org.apache.ignite:ignite-core MAVEN version 1.1.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.1.0-incubating - org.apache.ignite:ignite-aws...
org.apache.ignite:ignite-aop (1.1.0-incubating), org.apache.ignite:ignite-aws (1.1.0-incubating) +22 more potentially affected by CVE-2018-1295 via org.apache.ignite:ignite-core (1.1.0-incubating)
org.apache.ignite:ignite-core MAVEN version 1.1.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.1.0-incubating - org.apache.ignite:ignite-aws...
org.apache.ignite:ignite-aop (1.0.0-rc1), org.apache.ignite:ignite-aws (1.0.0-rc1) +22 more potentially affected by CVE-2018-1295 via org.apache.ignite:ignite-core (1.0.0-rc1)
org.apache.ignite:ignite-core MAVEN version 1.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.0.0-rc1 - org.apache.ignite:ignite-aws 1.0.0-rc1 -...
GHSA-CHP4-RV79-68J3 Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization
In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one...