EUVD-2020-19735

Malware in sbrugna...

EUVD-2022-0938

Malicious code in bioql PyPI...

CVE-2020-27217

In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated during link establishment. While the AMQP...

CVE-2020-27220

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configure...

io.quarkus:quarkus-elytron-security-oauth2 (>=1.11.0.cr1, <=1.12.2.final), io.quarkus:quarkus-elytron-security-oauth2-deployment (>=1.11.0.cr1, <=1.12.2.final) +49 more potentially affected by CVE-2024-1233 via org.wildfly.security:wildfly-elytron-realm-token (1.14.1.final)

org.wildfly.security:wildfly-elytron-realm-token MAVEN version 1.14.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.security:wildfly-elytron-realm-token and may be impacted: - io.quarkus:quarkus-elytron-security-oauth2 =1.11.0.cr1,...

io.quarkus:quarkus-infinispan-client (>=2.6.1.final, <=2.7.3.final), io.quarkus:quarkus-infinispan-client-deployment (>=2.6.1.final, <=2.7.3.final) +97 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (13.0.5.final)

org.infinispan:infinispan-commons MAVEN version 13.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - io.quarkus:quarkus-infinispan-client =2.6.1.final, =2.6.1.final, =2.6.1.final, =2.7.0,...

Improper Validation of Specified Quantity in Input in Eclipse Hono

In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated during link establishment. While the AMQP...

GHSA-9F52-HPVW-V96W Improper Validation of Specified Quantity in Input in Eclipse Hono

In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated during link establishment. While the AMQP...

org.eclipse.hono:hono-adapter-amqp-vertx (0.7), org.eclipse.hono:hono-adapter-http-vertx (0.7) +13 more potentially affected by CVE-2020-27217 via org.eclipse.hono:hono-core (0.7)

org.eclipse.hono:hono-core MAVEN version 0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.hono:hono-core and may be impacted: - org.eclipse.hono:hono-adapter-amqp-vertx 0.7 - org.eclipse.hono:hono-adapter-http-vertx 0.7 -...

org.eclipse.hono:hono-adapter-http-vertx-base (0.5-m5), org.eclipse.hono:hono-adapter-mqtt-vertx (0.5-m5) +5 more potentially affected by CVE-2020-27217 via org.eclipse.hono:hono-core (0.5-m5)

org.eclipse.hono:hono-core MAVEN version 0.5-m5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.hono:hono-core and may be impacted: - org.eclipse.hono:hono-adapter-http-vertx-base 0.5-m5 - org.eclipse.hono:hono-adapter-mqtt-vertx 0.5-m5 -...

org.eclipse.hono:hono-adapter-mqtt-vertx (0.5-m3), org.eclipse.hono:hono-adapter-rest-vertx (0.5-m3) +4 more potentially affected by CVE-2020-27217 via org.eclipse.hono:hono-core (0.5-m3)

org.eclipse.hono:hono-core MAVEN version 0.5-m3 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.hono:hono-core and may be impacted: - org.eclipse.hono:hono-adapter-mqtt-vertx 0.5-m3 - org.eclipse.hono:hono-adapter-rest-vertx 0.5-m3 -...

org.eclipse.hono:hono-adapter-rest-vertx (0.5-m1), org.eclipse.hono:hono-app (0.5-m1) +3 more potentially affected by CVE-2020-27217 via org.eclipse.hono:hono-core (0.5-m1)

org.eclipse.hono:hono-core MAVEN version 0.5-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.hono:hono-core and may be impacted: - org.eclipse.hono:hono-adapter-rest-vertx 0.5-m1 - org.eclipse.hono:hono-app 0.5-m1 -...

org.eclipse.hono:hono-adapter-http-vertx-base (0.5-m7), org.eclipse.hono:hono-adapter-mqtt-vertx (0.5-m7) +9 more potentially affected by CVE-2020-27217 via org.eclipse.hono:hono-core (0.5-m7)

org.eclipse.hono:hono-core MAVEN version 0.5-m7 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.hono:hono-core and may be impacted: - org.eclipse.hono:hono-adapter-http-vertx-base 0.5-m7 - org.eclipse.hono:hono-adapter-mqtt-vertx 0.5-m7 -...

CVE-2020-27220

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configure...

CVE-2020-27220

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configure...

Command injection

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configure...

CVE-2020-27220

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configure...

CVE-2020-27220

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configure...

PT-2021-11318

Name of the Vulnerable Software and Affected Versions: Eclipse Hono affected versions not specified Description: The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to...

CVE-2020-27220: Missing Authorization

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configure...