GSSC-CVE-2022-41923

Workaround for CVE-2022-41923: Privilege Management Vulnerability Summary The vulnerability CVE-2022-41923 found in the unpatched Grails Spring Security Core GSSC plugin can result in improper privilege management. This repository describes how to work around the issue. If you are using an...

net.myrrix:myrrix-web (0.11), net.myrrix:myrrix-web-common (0.11) +12 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (7.0.39)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - net.myrrix:myrrix-web 0.11 - net.myrrix:myrrix-web-common 0.11 -...

ch.rasc:embeddedtc (1.1), org.apache.tomcat.embed:tomcat-embed-jasper (7.0.30) +3 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (7.0.30)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.30 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.rasc:embeddedtc 1.1 - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.30 ...

net.myrrix:myrrix-web (0.11), net.myrrix:myrrix-web-common (0.11) +12 more potentially affected by CVE-2026-41284 via org.apache.tomcat:tomcat-catalina (7.0.39)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - net.myrrix:myrrix-web 0.11 - net.myrrix:myrrix-web-common 0.11 -...

net.myrrix:myrrix-web (0.11), net.myrrix:myrrix-web-common (0.11) +12 more potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat-catalina (7.0.39)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - net.myrrix:myrrix-web 0.11 - net.myrrix:myrrix-web-common 0.11 -...

CVE-2018-1000817

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

io.github.matrei:grails-inertia-plugin (2.0.0), org.grails.plugins:gsp (>=6.0.1, <=6.0.3) +22 more potentially affected by CVE-2023-46131 via org.grails:grails-databinding (6.0.0)

org.grails:grails-databinding MAVEN version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-databinding and may be impacted: - io.github.matrei:grails-inertia-plugin 2.0.0 - org.grails.plugins:gsp =6.0.1, =6.0.3 -...

PT-2022-26153 · Grails · Grails Spring Security Core Plugin

Name of the Vulnerable Software and Affected Versions: Grails Spring Security Core plugin versions 1.x Grails Spring Security Core plugin versions 2.x Grails Spring Security Core plugin versions 3.0.0 through 3.3.1 Grails Spring Security Core plugin versions 4.0.0 through 4.0.4 Grails Spring...

org.grails:grails-dependencies (2.4.0.rc1), org.grails:grails-encoder (2.4.0.rc1) +33 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.4.0.rc1)

org.grails:grails-core MAVEN version 2.4.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.4.0.rc1 - org.grails:grails-encoder 2.4.0.rc1 -...

org.grails:grails-dependencies (2.4.0), org.grails:grails-encoder (2.4.0) +32 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.4.0)

org.grails:grails-core MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.4.0 - org.grails:grails-encoder 2.4.0 - org.grails:grails-logging 2.4.0 -...

org.grails:grails-datastore-gorm-grails2-support (>=6.1.0.release, <=6.1.9.release), org.grails:grails-datastore-gorm-grails2-test (>=6.1.0.release, <=6.1.9.release) +35 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.5.6)

org.grails:grails-core MAVEN version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm-grails2-support =6.1.0.release, =6.1.0.release, =6.1.9.release -...

org.grails:grails-plugin-testing (2.0.2) potentially affected by CVE-2019-12728 via org.grails:grails-core (2.0.2)

org.grails:grails-core MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-plugin-testing 2.0.2 Source cves: CVE-2019-12728 Source advisory: OSV:GHSA-PMXF-4V8C-RWR7...

org.grails:grails-dependencies (2.1.1), org.grails:grails-plugin-testing (2.1.1) potentially affected by CVE-2019-12728 via org.grails:grails-core (2.1.1)

org.grails:grails-core MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.1.1 - org.grails:grails-plugin-testing 2.1.1 Source cves: CVE-2019-12728 Source...

org.grails:grails-datastore-gorm (>=3.1.3.release, <=3.1.5.release), org.grails:grails-datastore-gorm-cassandra (1.0.0-m01) +31 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.3.11)

org.grails:grails-core MAVEN version 2.3.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm =3.1.3.release, =3.1.3.release, =3.1.3.release, =3.1.3.release, =3.1.4.release,...

org.grails:grails-dependencies (2.5.1), org.grails:grails-encoder (2.5.1) +33 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.5.1)

org.grails:grails-core MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.5.1 - org.grails:grails-encoder 2.5.1 - org.grails:grails-logging 2.5.1 -...

org.grails:grails-dependencies (2.2.0.rc1), org.grails:grails-hibernate (2.2.0.rc1) +16 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.2.0.rc1)

org.grails:grails-core MAVEN version 2.2.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.2.0.rc1 - org.grails:grails-hibernate 2.2.0.rc1 - org.grails:grails-logging...

org.grails:grails-datastore-gorm-grails2-support (>=6.0.0.rc1, <=6.1.0.rc2), org.grails:grails-datastore-gorm-grails2-test (>=6.0.0.rc1, <=6.1.0.rc2) +35 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.5.5)

org.grails:grails-core MAVEN version 2.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm-grails2-support =6.0.0.rc1, =6.0.0.rc1, =6.1.0.rc2 - org.grails:grails-dependencie...

GHSA-W73Q-MC9G-J56X Asset Pipeline Grails Plugin vulnerable to Path Traversal

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

Asset Pipeline Grails Plugin vulnerable to Path Traversal

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

CVE-2018-1000817

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...