GHSA-CHP4-RV79-68J3 Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one...

com.github.rubanm:ignite-scala_2.10 (0.0.1), com.github.rubanm:ignite-scala_2.11 (0.0.1) +23 more potentially affected by CVE-2018-1295 via org.apache.ignite:ignite-core (1.0.0)

org.apache.ignite:ignite-core MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - com.github.rubanm:ignite-scala2.10 0.0.1 - com.github.rubanm:ignite-scala2.11 0.0.1 -...

org.apache.ignite:ignite-aop (1.2.0-incubating), org.apache.ignite:ignite-aws (1.2.0-incubating) +23 more potentially affected by CVE-2018-1295 via org.apache.ignite:ignite-core (1.2.0-incubating)

org.apache.ignite:ignite-core MAVEN version 1.2.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.2.0-incubating - org.apache.ignite:ignite-aws...

org.apache.ignite:ignite-aop (1.0.0-rc3), org.apache.ignite:ignite-aws (1.0.0-rc3) +21 more potentially affected by CVE-2018-1295 via org.apache.ignite:ignite-core (1.0.0-rc3)

org.apache.ignite:ignite-core MAVEN version 1.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.0.0-rc3 - org.apache.ignite:ignite-aws 1.0.0-rc3 -...

Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one...

Moderate severity vulnerability that affects org.apache.ignite:ignite-core

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents...

GHSA-8QFC-CVJP-MGPQ Moderate severity vulnerability that affects org.apache.ignite:ignite-core

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents...

org.apache.ignite:ignite-aop (1.2.0-incubating), org.apache.ignite:ignite-aws (1.2.0-incubating) +23 more potentially affected by CVE-2017-7686 via org.apache.ignite:ignite-core (1.2.0-incubating)

org.apache.ignite:ignite-core MAVEN version 1.2.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.2.0-incubating - org.apache.ignite:ignite-aws...

org.apache.ignite:ignite-aop (1.0.0-rc1), org.apache.ignite:ignite-aws (1.0.0-rc1) +22 more potentially affected by CVE-2017-7686 via org.apache.ignite:ignite-core (1.0.0-rc1)

org.apache.ignite:ignite-core MAVEN version 1.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.0.0-rc1 - org.apache.ignite:ignite-aws 1.0.0-rc1 -...

Apache Ignite communicates to an external PHP server where sensitive information is sent

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

org.apache.ignite:ignite-aop (1.1.0-incubating), org.apache.ignite:ignite-aws (1.1.0-incubating) +22 more potentially affected by CVE-2017-7686 via org.apache.ignite:ignite-core (1.1.0-incubating)

org.apache.ignite:ignite-core MAVEN version 1.1.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.1.0-incubating - org.apache.ignite:ignite-aws...

org.apache.ignite:ignite-aop (1.3.0-incubating), org.apache.ignite:ignite-aws (1.3.0-incubating) +24 more potentially affected by CVE-2017-7686 via org.apache.ignite:ignite-core (1.3.0-incubating)

org.apache.ignite:ignite-core MAVEN version 1.3.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.3.0-incubating - org.apache.ignite:ignite-aws...

GHSA-8P83-68CW-943F Apache Ignite communicates to an external PHP server where sensitive information is sent

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

com.github.rubanm:ignite-scala_2.10 (0.0.1), com.github.rubanm:ignite-scala_2.11 (0.0.1) +23 more potentially affected by CVE-2017-7686 via org.apache.ignite:ignite-core (1.0.0)

org.apache.ignite:ignite-core MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - com.github.rubanm:ignite-scala2.10 0.0.1 - com.github.rubanm:ignite-scala2.11 0.0.1 -...

org.apache.ignite:ignite-aop (1.0.0-rc3), org.apache.ignite:ignite-aws (1.0.0-rc3) +21 more potentially affected by CVE-2017-7686 via org.apache.ignite:ignite-core (1.0.0-rc3)

org.apache.ignite:ignite-core MAVEN version 1.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.0.0-rc3 - org.apache.ignite:ignite-aws 1.0.0-rc3 -...

ignite: Possible Execution of Arbitrary Code Within Deserialization Endpoints

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one...

Apache Ignite Arbitrary Code Execution Vulnerability (CNVD-2018-15540)

Apache Ignite is the United States Apache Apache Software Foundation's set of high-performance, integrated and distributed for large-scale data set processing in-memory computing and transaction management platform. An arbitrary code execution vulnerability exists in Apache Ignite 2.5 and earlier...

CVE-2018-8018

In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be...

CVE-2018-8018

In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be...

Deserialization of untrusted data

In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be...