GHSA-G2HF-G7FH-VG92 Apache Brooklyn is vulnerable to cross-site request forgery (CSRF)

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery CSRF, which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as the user. There is...

Apache Brooklyn is vulnerable to cross-site request forgery (CSRF)

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery CSRF, which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as the user. There is...

Cross-site Scripting In Apache Brooklyn

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to ...

GHSA-J3G9-3FVV-GQFP Cross-site Scripting In Apache Brooklyn

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to ...

GHSA-9CQH-5X6G-WGM9 Deserialization of Untrusted Data in Apache Brooklyn

Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...

Deserialization of Untrusted Data in Apache Brooklyn

Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...

com.approvaltests:approvaltests-hadoop (>=2.0.0 <=7.0.0), io.brooklyn.example:brooklyn-example-hello-world-hadoop-webapp (>=0.4.0 <=0.7.0-M1) +6 more potentially affected by CVE-2012-4449 via org.apache.hadoop:hadoop-client (>=1.0.2 <=1.0.3)

org.apache.hadoop:hadoop-client MAVEN version =1.0.2, =2.0.0, =0.4.0, =0.12, =0.13, =0.3.0-incubating, =0.4.0-incubating, =0.3.0-incubating, =0.6.0 Source cves: CVE-2012-4449 Source advisory: OSV:GHSA-Q46V-CJ5V-HVG6...

brooklynhealthworks.com Cross Site Scripting vulnerability OBB-2349553

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Friday Squid Blogging: Squid Mural

Large squid mural in the Bushwick neighborhood of Brooklyn. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Alleged Russian Hacker Pleads Not Guilty After Extradition to United States

A Russian hacker indicted by a United States court for his involvement in online ad fraud schemes that defrauded multiple American companies out of tens of millions of dollars pleaded not guilty on Friday in a courtroom in Brooklyn, New York. Aleksandr Zhukov , 38, was arrested in November last...

Remote Code Execution (RCE)

brooklyn-utils-common is vulnerable to remote code execution RCE attacks. The library by default allows the unmarshalling of Java types available to that classpath. This allows an attacker to inject and execute arbitrary code by passing a malicious yaml file to the application...

brooklyn-theater.com XSS vulnerability

Open Bug Bounty ID: OBB-360996 Description| Value ---|--- Affected Website:| brooklyn-theater.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

Apache Brooklyn Remote Code Execution Vulnerability

Apache Brooklyn is the United States Apache Apache Software Foundation's set of frameworks for deploying and managing distributed applications by monitoring and managing applications. A security vulnerability exists in SnakeYAML in versions of Apache Brooklyn prior to 0.10.0. An attacker could...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server. PoC Attacker puts something like this int...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server. PoC Attacker puts something like this int...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server. PoC Attacker puts something like this int...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server. PoC Attacker puts something like this int...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server. PoC Attacker puts something like this int...

Cross-site Request Forgery (CSRF)

Overview org.apache.brooklyn:brooklyn-jsgui is a software for managing cloud applications. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the...

Cross site scripting

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to ...