22 matches found
Deserialization Of Untrusted Data
Apache Causeway is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unsafe Java deserialization of user-controllable URL parameters in ViewModel handling, which allows an authenticated attacker to execute arbitrary code with application privileges...
Apache Causeway Deserialization Vulnerability
Apache Causeway is the Apache Foundation of a Java rapid application development framework . Apache Causeway suffers from a deserialization vulnerability that originates from unsafe deserialization of user-controllable URL parameters in the receipt of serialized data submitted by the user, which...
CVE-2025-64408
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution RCE through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary cod...
GHSA-WQ4C-57MH-5F7G Apache Causeway vulnerable to deserialization in Java
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution RCE through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary cod...
Apache Causeway vulnerable to deserialization in Java
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution RCE through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary cod...
EUVD-2025-198152
Apache Causeway vulnerable to deserialization in Java...
CVE-2025-64408
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution RCE through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary cod...
dev.savantly.nexus:agents-module (3.4.0), dev.savantly.nexus:common-types-module (3.4.0) +156 more potentially affected by CVE-2025-64408 via org.apache.causeway.commons:causeway-commons (>=2.0.0, <=4.0.0-m2)
org.apache.causeway.commons:causeway-commons MAVEN version =2.0.0, =4.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.causeway.commons:causeway-commons and may be impacted: - dev.savantly.nexus:agents-module 3.4.0 -...
dev.savantly.nexus:nexus-command-webapp (3.4.0), org.apache.causeway.mavendeps:causeway-mavendeps-webapp (>=2.0.0-rc1, <=4.0.0-m2) potentially affected by CVE-2025-64408 via org.apache.causeway.viewer:causeway-viewer-wicket-viewer (>=2.0.0, <=4.0.0-m2)
org.apache.causeway.viewer:causeway-viewer-wicket-viewer MAVEN version =2.0.0, =2.0.0-rc1, =4.0.0-m2 Source cves: CVE-2025-64408 Source advisory: SNYK:JAVA-ORGAPACHECAUSEWAYVIEWER-14052594...
dev.savantly.nexus:agents-module (3.4.0), dev.savantly.nexus:flow-module (3.4.0) +43 more potentially affected by CVE-2025-64408 via org.apache.causeway.core:causeway-core-runtimeservices (>=2.0.0, <=4.0.0-m2)
org.apache.causeway.core:causeway-core-runtimeservices MAVEN version =2.0.0, =4.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.causeway.core:causeway-core-runtimeservices and may be impacted: - dev.savantly.nexus:agents-module 3.4.0 ...
dev.savantly.nexus:agents-module (3.4.0), dev.savantly.nexus:flow-module (3.4.0) +129 more potentially affected by CVE-2025-64408 via org.apache.causeway.core:causeway-core-metamodel (>=2.0.0, <=4.0.0-m2)
org.apache.causeway.core:causeway-core-metamodel MAVEN version =2.0.0, =4.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.causeway.core:causeway-core-metamodel and may be impacted: - dev.savantly.nexus:agents-module 3.4.0 -...
dev.savantly.nexus:agents-module (3.4.0), dev.savantly.nexus:common-types-module (3.4.0) +152 more potentially affected by CVE-2025-64408 via org.apache.causeway.core:causeway-applib (>=2.0.0, <=4.0.0-m2)
org.apache.causeway.core:causeway-applib MAVEN version =2.0.0, =4.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.causeway.core:causeway-applib and may be impacted: - dev.savantly.nexus:agents-module 3.4.0 -...
dev.savantly.nexus:agents-module (3.4.0), dev.savantly.nexus:flow-module (3.4.0) +135 more potentially affected by CVE-2025-64408 via org.apache.causeway.core:causeway-core-config (>=2.0.0, <=4.0.0-m2)
org.apache.causeway.core:causeway-core-config MAVEN version =2.0.0, =4.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.causeway.core:causeway-core-config and may be impacted: - dev.savantly.nexus:agents-module 3.4.0 -...
CVE-2025-64408 Apache Causeway: Java deserialization vulnerability to authenticated attackers
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution RCE through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary cod...
CVE-2025-64408 Apache Causeway: Java deserialization vulnerability to authenticated attackers
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution RCE through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary cod...
Apache Causeway 安全漏洞
Apache Causeway is the Apache Foundation of a Java rapid application development framework . Apache Causeway suffers from a deserialization vulnerability that originates from unsafe deserialization of user-controllable URL parameters in the receipt of serialized data submitted by the user, which...
PT-2025-47450
Name of the Vulnerable Software and Affected Versions Apache Causeway affected versions not specified Description Apache Causeway is susceptible to Java deserialization issues that can lead to remote code execution RCE. Exploitation occurs through user-controllable URL parameters. Authenticated...
CVE-2025-64408: Deserialization of Untrusted Data
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution RCE through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary cod...
A Bootiful Podcast: Apache Causeway’s Dan Haywood
Hi, Spring fans! In this installment I talk to the legendary Dan Haywood, contributor to the Apache Causeway project...
This Week in Spring - January 7th, 2025
Hi, Spring fans, and happy new year! It's been another super seven days since we last spoke and, as always, there's a lot to cover so let's dive right into it! A long time in coming, but it's finally here! Hello DCO, Goodbye CLA: Simplifying Contributions to Spring the Spring AI hits just keep on...