CVE-2022-34870 Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application

Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting XSS via data injection when using Pulse web application to view Region entries...

CVE-2022-34870 Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application

Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting XSS via data injection when using Pulse web application to view Region entries...

CVE-2022-34870 Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application

Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting XSS via data injection when using Pulse web application to view Region entries...

CVE-2022-34870

CVE-2022-34870 : Concrete details from connected records show that Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using the Pulse web application to view Region entries. The underlying issue is described as an XSS in the Pulse data-inject...

Apache Geode 跨站脚本漏洞

Apache Geode is the Apache Foundation's suite of management platforms for providing real-time and consistent access to data for data-intensive applications in distributed cloud architectures. A security vulnerability exists in Apache Geode versions prior to 1.15.0. An attacker could exploit this...

The vulnerability of the JMX data management platform of Apache Geode allows an attacker to execute arbitrary code.

The vulnerability of the JMX data management platform of Apache Geode involves the restoration of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the JMX data management platform of Apache Geode allows an attacker to execute arbitrary code.

The vulnerability of the JMX data management platform of Apache Geode involves the restoration of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the REST API interface of the Apache Geode data management platform allows a hacker to execute arbitrary code.

The vulnerability of the REST API interface of the Apache Geode data management platform involves the restoration of unreliable data in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Deserialization Of Untrusted Data

Apache Geode is vulnerable to deserialization of untrusted data. The vulnerability exists because the process-wide serialization filters are not properly configured on REST APIs which allows an attacker to inject and execute arbitrary code through the untrusted data...

Deserialization Of Untrusted Data

Apache Geode is vulnerable to deserialization of untrusted data. The vulnerability exists because the process-wide serialization filter is not properly configured when validate-serializable-objects is enabled which allows an attacker to inject and execute arbitrary code through the untrusted data...

Deserialization Of Untrusted Data

apache-geode is vulnerable to deserialization of untrusted data. The vulnerability exists because the serialization filtering is not properly configured for JMX/RMI which allows an attacker to to inject and execute arbitrary code through the untrusted data...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=2.0.0 <=2.0.2), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=2.0.0 <=3.0.4) +53 more potentially affected by CVE-2022-37023 via org.apache.geode:geode-core (>=1.0.0-incubating <=1.14.4)

org.apache.geode:geode-core MAVEN version =1.0.0-incubating, =2.0.0, =2.0.0, =2.0.0, =0.3.12, =0.3.5, =2.4.0, =1.22.0, =1.14.0, =1.10.0, =1.10.0, =1.10.0, =1.12.0, =1.11.0, =1.14.4 and more Source cves: CVE-2022-37023 Source advisory: OSV:GHSA-72X9-48MC-PHH6...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (=2.0.2), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=2.0.2 <=3.0.4) +41 more potentially affected by CVE-2022-37021 via org.apache.geode:geode-core (>=1.13.0 <=1.13.4)

org.apache.geode:geode-core MAVEN version =1.13.0, =2.0.2, =2.0.2, =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13.2, =1.13.2, =1.13.2, =1.13.0, =1.13.0, =1.13.4 and more Source cves: CVE-2022-37021 Source advisory: OSV:GHSA-Q4Q3-R45F-7GWG...

GHSA-72X9-48MC-PHH6 Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data

Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details o...

GHSA-Q4Q3-R45F-7GWG Apache Geode vulnerable to Deserialization of Untrusted Data

Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. ...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=2.0.0 <=2.0.2), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=2.0.0 <=3.0.4) +53 more potentially affected by CVE-2022-37022 via org.apache.geode:geode-core (>=1.0.0-incubating <=1.14.4)

org.apache.geode:geode-core MAVEN version =1.0.0-incubating, =2.0.0, =2.0.0, =2.0.0, =0.3.12, =0.3.5, =2.4.0, =1.22.0, =1.14.0, =1.10.0, =1.10.0, =1.10.0, =1.12.0, =1.11.0, =1.14.4 and more Source cves: CVE-2022-37022 Source advisory: OSV:GHSA-QF8G-VPWP-6579...

Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data

Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details o...

Apache Geode vulnerable to Deserialization of Untrusted Data

Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. ...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=2.0.0 <=2.0.1), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=2.0.0 <=2.0.1) +51 more potentially affected by CVE-2022-37021 via org.apache.geode:geode-core (>=1.0.0-incubating <=1.12.1)

org.apache.geode:geode-core MAVEN version =1.0.0-incubating, =2.0.0, =2.0.0, =2.0.0, =0.3.12, =0.3.5, =2.4.0, =1.22.0, =1.10.0, =1.10.0, =1.10.0, =1.12.0, =1.11.0, =1.0.0-incubating, =1.12.1 and more Source cves: CVE-2022-37021 Source advisory: OSV:GHSA-Q4Q3-R45F-7GWG...

org.apache.geode:geode-apis-compatible-with-redis (=1.14.0), org.apache.geode:geode-connectors (=1.14.0) +25 more potentially affected by CVE-2022-37021 via org.apache.geode:geode-core (=1.14.0)

org.apache.geode:geode-core MAVEN version =1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.geode:geode-core and may be impacted: - org.apache.geode:geode-apis-compatible-with-redis =1.14.0 - org.apache.geode:geode-connectors =1.14.0 -...