CVE-2018-11787

In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web...

CVE-2018-11786

Apache Karaf prior to 4.2.0 is vulnerable: if the sshd service is left enabled, any user with Karaf console rights can pivot to read/write files accessible to the Karaf process user. The issue stems from insufficient isolation once an administrator session is active, allowing privilege elevation ...

CVE-2018-11787

CVE-2018-11787 affects Apache Karaf prior to 3.0.9, 4.0.9 and 4.1.1 where the webconsole opens a Gogo shell and, if Pax Web Extender Whiteboard is present, an unauthenticated /gogo URL can expose the Karaf console. Direct access to /system/console/gogo also requires authentication, but the /gogo ...

CVE-2018-11786

In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a...

Apache Karaf LDAP Injection Vulnerability

Apache Karaf is open source OSGi based runtime environment. Apache Karaf version before 4.0.8 through the LDAPLoginModule to authenticate the user directory access through LDAP , there is a security vulnerability in the implementation , successful exploitation can lead to LDAP injection attacks ,...

Design/Logic Flaw

Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service...

CVE-2016-8750

Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service...

CVE-2016-8750

Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service...

CVE-2016-8750

CVE-2016-8750 affects Apache Karaf prior to 4.0.8. The LDAPLoginModule did not properly encode usernames when authenticating via LDAP, exposing a vulnerability to LDAP injection that can lead to Denial of Service. Vulnerable component: Karaf’s LDAP authentication path; root cause: improper userna...

CVE-2016-8750

Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service...

Apache Karaf Local Denial of Service Vulnerability

Apache Karaf is the United States Apache Apache Software Foundation for the deployment of applications and components of a lightweight OSGi Java Dynamic Modular System container. A local denial of service vulnerability exists in Apache Karaf. A local attacker could exploit this vulnerability by...

Authentication flaw

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service shutdown by sending a shutdown command to all listening high ports...

CVE-2014-0219

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service shutdown by sending a shutdown command to all listening high ports...

CVE-2014-0219

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service shutdown by sending a shutdown command to all listening high ports...

CVE-2014-0219

Apache Karaf before 4.0.10 is affected by CVE-2014-0219. The issue allows local users to trigger a denial of service by sending a shutdown command to the shutdown port exposed on the loopback interface, targeting all listening high ports. The vulnerability stems from a misconfigured shutdown port...

BlackBerry Good Enterprise Mobility Server Arbitrary Command Execution Vulnerability

The BlackBerry Good Enterprise Mobility Server GEMS is an enterprise mobility server from BlackBerry Canada. A security vulnerability exists in Apache Karaf in BlackBerry GEMS versions 2.1.5.3 through 2.2.22.25. A remote attacker could exploit the vulnerability by executing commands to gain local...

CVE-2016-3129

A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server GEMS implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf...

CVE-2016-3129

A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server GEMS implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf...

Remote code execution

A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server GEMS implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf...

CVE-2016-3129

The CVE-2016-3129 entry describes a remote code execution vulnerability in BlackBerry Good Enterprise Mobility Server (GEMS) via the Apache Karaf command shell. Affected versions are 2.1.5.3 through 2.2.22.25. An attacker can execute commands to gain local administrator rights on the GEMS server....