CVE-2020-17531 Deserialization flaw in EOL Tapestry 4.

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to...

CVE-2020-17531

CVE-2020-17531 affects Apache Tapestry 4. It describes a Java deserialization vulnerability where the server will deserialize the sp parameter before page validation, allowing deserialization without authentication. Tapestry 4 is end-of-life (2008) and no fix will be released; Tapestry 5 is not a...

CVE-2020-13953

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run...

CVE-2020-13953

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run...

Code injection

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run...

CVE-2020-13953

This CVE relates to Apache Tapestry where an information disclosure vulnerability allows an attacker to download files in WEB-INF via specially crafted URLs. The issue stems from an incomplete fix for CVE-2020-13953 and affects Apache Tapestry 5.4.0–5.6.3, with related advisories noting impact on...

CVE-2020-13953

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run...

The vulnerability of the String.equals() function in the Apache Tapestry software platform allows a hacker to execute arbitrary code.

The vulnerability of the String.equals function in the Apache Tapestry software platform exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

GHSA-FGMR-VX7C-5WJ6 Timing attack on HMAC signature comparison in Apache Tapestry

The code which checks HMAC in form submissions used String.equals for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison...

Timing attack on HMAC signature comparison in Apache Tapestry

The code which checks HMAC in form submissions used String.equals for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison...

Apache Tapestry 5.3.6 HMAC Timing Attack Vulnerability

Exploit for java platform in category web applications CVE-2019-10071: Timing Attack in HMAC Verification in Apache Tapestry Affected versions: - Apache Tapestry 5.3.6 through current releases. Description: Apache Tapestry uses HMACs to verify the integrity of objects stored on the client side...

Apache Tapestry Denial of Service Vulnerability

Apache Tapestry is the United States Apache Apache Software Foundation developed a set of frameworks used to create Java-based Web applications. A security vulnerability exists in Apache Tapestry versions prior to 5.3.6, which arises from the program's failure to check for tampering when storing...

Code injection

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service resource consumption or execute arbitrary code via crafted serialized data...

CVE-2014-1972

Apache Tapestry prior to 5.3.6 is vulnerable due to storing objects on the client side without verifying client modifications, enabling denial of service or arbitrary code execution via crafted serialized data. Affected: Apache Tapestry versions up to 5.3.5 (and 5.3.x prior to 5.3.6). Root cause:...

CVE-2014-1972

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service resource consumption or execute arbitrary code via crafted serialized data...

Apache Tapestry deserializes untrusted data

Overview Apache Tapestry contains a vulnerability where it may deserialize untrusted data. Apache Tapestry is a framework for creating Java web applications. Apache Tapestry contains an interface where client side serialized data sent to the server is deserialized after it is received by the...

JVN#17611367: Apache Tapestry deserializes untrusted data

Apache Tapestry is a framework for creating Java web applications. Apache Tapestry contains an interface where client side serialized data sent to the server is deserialized after it is received by the server. This data serialization / deserialization process does not contain data validation...