EUVD-2022-4038

Malicious code in bioql PyPI...

EUVD-2022-4909

Malicious code in bioql PyPI...

EUVD-2022-3292

Malicious code in bioql PyPI...

EUVD-2022-2821

Malicious code in bioql PyPI...

EUVD-2022-7000

Malicious code in bioql PyPI...

EUVD-2022-5357

Malicious code in bioql PyPI...

EUVD-2022-3891

Malicious code in bioql PyPI...

EUVD-2022-1223

Malicious code in bioql PyPI...

EUVD-2022-0653

Malicious code in bioql PyPI...

EUVD-2022-6726

Malicious code in bioql PyPI...

EUVD-2022-6906

Malicious code in bioql PyPI...

EUVD-2022-1987

Malicious code in bioql PyPI...

EUVD-2022-6916

Malicious code in bioql PyPI...

CVE-2022-34870

Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting XSS via data injection when using Pulse web application to view Region entries...

CVE-2022-37022

Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will...

CVE-2021-34797

Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This iss...

CVE-2019-10091

When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication using a man-in-the-middle attack...

CVE-2017-15694

When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cluster metadata. A malicious user could modify this data in a way that affects the operation of the cluster...

Cross-Site Scripting (XSS)

apache-geode is vulnerable to cross-site scripting. The vulnerability exists in multiple functions due to data injection when using pulse web application which allows an attacker to steal the admin's session cookie for the admin account...

GHSA-373R-9MG8-3JC4 Apache Geode vulnerable to Cross-Site Scripting

Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting XSS via data injection when using Pulse web application to view Region entries...