Lucene search
+L

6 matches found

NVD
NVD
•added 2026/09/14 3:17 p.m.•13 views

CVE-2026-82428

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

8.8CVSS0.00693EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/09/14 2:18 p.m.•15 views

CVE-2026-82428 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

6.1AI score0.00693EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/14 2:18 p.m.•15 views

EUVD-2026-77529

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

8.8CVSS6.1AI score0.00693EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/14 2:18 p.m.•43 views

CVE-2026-82428 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

0.00693EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/14 2:18 p.m.•25 views

CVE-2026-82428

The Apache Storm Client is vulnerable to cross-tenant dependency jar substitution due to predictable blob keys. When using the storm jar --artifacts feature, dependency artifacts are stored under keys derived solely from Maven coordinates (e.g., dep---.jar). Because these keys are predictable and...

8.8CVSS6.1AI score0.00693EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2019/04/10 12:29 a.m.•39 views

CVE-2019-11065

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site...

5.9CVSS6.8AI score0.01577EPSS
SaveExploits0References3
Rows per page
Query Builder