CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

CVE-2018-11798

The CVE-2018-11798 entry concerns Apache Thrift Node.js static web server (versions 0.9.2–0.11.0) where a remote attacker can access files outside the webroot docroot. Connected sources also reference CVE-2018-1320 in the Thrift TSaslTransport SASL handshake validation issue. NVD metrics cite a b...

CVE-2018-11798

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path...

CVE-2018-11798

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path...

CVE-2018-11798

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path...

CVE-2018-11798

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path...

CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

Input validation

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

UBUNTU-CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

Path traversal

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path...

DEBIAN-CVE-2018-11798

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path...

CVE-2018-11798: Insertion of Sensitive Information into Externally-Accessible File or Directory

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path...

CVE-2018-1320: Improper Certificate Validation

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making t...

PT-2019-3599

Name of the Vulnerable Software and Affected Versions Apache Thrift Java client library versions 0.5.0 through 0.11.0 Description The issue is related to insufficient input validation in the org.apache.thrift.transport.TSaslTransport class, allowing a remote attacker to bypass SASL negotiation...

Security Bulletin: IBM Security Guardium is affected by a Using Components (lib) with Known Vulnerabilities vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2015-3254 DESCRIPTION: Apache Thrift is vulnerable to a denial of service, caused by an error in the client libraries. A remote authenticated attacker could exploit this vulnerability to...

PT-2018-2890

Name of the Vulnerable Software and Affected Versions Apache Thrift Node.js versions 0.9.2 through 0.11.0 Description The issue allows a remote user to access files outside the set web server's docroot path due to a security vulnerability in the Apache Thrift Node.js static web server. This...

Remote Code Execution (RCE)

github.com/apache/thrift is vulnerable to remote code execution RCE attacks. The vulnerability exists in formatgootuput of tgogenerator.cc where a malicious user can provide a service name which could deliver a payload that leads to RCE attacks...

Apache Thrift Go client library remote code execution vulnerability

Apache Thrift is the United States Apache Apache Software Foundation's set of remote invocation framework , which allows in the definition file to define data types and service interfaces . Go client library is one of the client library . The Go client library in Apache Thrift is vulnerable to a...