EUVD-2024-0895

Malicious code in bioql PyPI...

EUVD-2022-6774

Malicious code in bioql PyPI...

EUVD-2023-2084

Malicious code in bioql PyPI...

EUVD-2022-6846

Malicious code in bioql PyPI...

EUVD-2022-7246

Malicious code in bioql PyPI...

EUVD-2023-3156

Malicious code in bioql PyPI...

EUVD-2024-0609

Malicious code in bioql PyPI...

EUVD-2022-6680

Malicious code in bioql PyPI...

EUVD-2022-6863

Malicious code in bioql PyPI...

EUVD-2024-0948

Malicious code in bioql PyPI...

EUVD-2022-0797

Malicious code in bioql PyPI...

EUVD-2023-1947

Malicious code in bioql PyPI...

EUVD-2025-10663

Malicious code in bioql PyPI...

EUVD-2023-2059

Malicious code in bioql PyPI...

CVE-2023-30428

Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role. This issue affects Apache Pulsar Brokers: from 2.9.0 through 2.9.5, from...

CVE-2023-51437

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...

CVE-2022-33682

TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle...

CVE-2022-24280

Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address. When the Apache Pulsar Proxy component is used, it is possible to attempt to open TCP/IP connections to any IP addre...

CVE-2021-22160

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...

Insertion Of Sensitive Information Into Log File

Apache Pulsar is vulnerable to Insertion of Sensitive Information into Log File. The vulnerability is due to sensitive data exposure due to logging of plaintext Kafka credentials in application logs by various Kafka connectors...