94924 matches found
CVE-2026-91012
A path traversal vulnerability exists in Apache Karaf within the org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties) method, which supports the config MBean and config: oo shell commands. The root cause is the lack of validation to ensure that caller-supplied input stay...
EUVD-2026-88660
org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...
RHLW-2026-F8FC2683E717E6A2 Lightwell Security Advisory: commons-io 2.13.0.rhlw-00007
Red Hat Lightwell has released commons-io:commons-io 2.13.0.rhlw-00007 with a backported security fix. CVE-2024-47554: Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader This patched artifact is a drop-in replacement for commons-io:commons-io 2.13.0 from...
Cross-Site Request Forgery
Apache Wicket is vulnerable to cross-site request forgery. The vulnerability is due to unsafe allowances in the default FetchMetadataResourceIsolationPolicy, where any "simple top-level navigation" GET request is allowed regardless of Sec-Fetch-Site and Sec-Fetch-Mode, and Sec-Fetch-Site: same-si...
Insufficient Technical Documentation
Apache Tomcat is vulnerable to Insufficient Technical Documentation. The vulnerability is due to insufficient security configuration guidance, which could allow an administrator to deploy Tomcat with an insecure EncryptInterceptor configuration and potentially expose protected cluster communicati...
CVE-2026-86247
A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or...
CVE-2017-12615
CVE-2017-12615 - Apache Tomcat 원격 코드 실행 RCE CVE-2017-12615 는 Microsoft Windows 에서 실행되는 Apache Tomcat 7.0.0 7.0.79 버전에 영향을 미치는 원격 코드 실행RCE 취약점으로, HTTP PUT 요청이 활성화된 경우에 발생합니다. 이 취약점은 DefaultServlet 의 readonly 파라미터가 false로 설정된 상태에서 Tomcat이 업로드된 JSP 파일을 잘못 처리하기 때문에 존재합니다. 이러한 조건에서 인증되지 않은 공격자는 웹 서버에 ...
CVE-2026-34197
CVE-2026-34197 - Apache ActiveMQ Jolokia 원격 코드 실행 RCE CVE-2026-34197은 Apache ActiveMQ Classic에 영향을 미치는 높은 심각도의 원격 코드 실행 RCE 취약점입니다. 이 문제는 /api/jolokia/ 엔드포인트를 통해 HTTP로 관리 작업을 노출하는 Jolokia JMX-HTTP 브리지에 존재합니다. 기본 Jolokia 액세스 정책은 인증된 사용자가 ActiveMQ MBeans에서 관리 작업을 호출할 수 있도록 허용합니다. 특정 브로커 관리 메서드는 사용자...
CLEANSTART-2026-OM37971 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-FN35430 Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function
Security vulnerability affects the apache-superset package. Issue summary: Processing a malformed PKCS12 file can trigger a NULL pointer dereference in the PKCS12itemdecryptd2iex function...
CLEANSTART-2026-PD89526 Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification
Security vulnerability affects the apache-superset package. Issue summary: PBMAC1 parameters in PKCS12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification...
CLEANSTART-2026-VT26108 memory leak occurs in Node
Security vulnerability affects the apache-superset package. A memory leak occurs in Node...
CLEANSTART-2026-NP94260 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-TF09981 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-DI68809 memory leak in Node
Security vulnerability affects the apache-superset package. A memory leak in Node...
CLEANSTART-2026-MI22504 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-UP28744 malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node
Security vulnerability affects the apache-superset package. A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node...
CLEANSTART-2026-UC30604 flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable
Security vulnerability affects the apache-superset package. A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable...