GHSA-PMXF-4V8C-RWR7 Incorrect Resource Transfer Between Spheres in Grails

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP...

Asset Pipeline plugin for Grails vulnerable to Path Traversal

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in...

GHSA-G7WM-22M6-5774 Asset Pipeline plugin for Grails vulnerable to Path Traversal

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in...

Asset Pipeline Grails Plugin vulnerable to Path Traversal

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

GHSA-W73Q-MC9G-J56X Asset Pipeline Grails Plugin vulnerable to Path Traversal

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

ai.stainless:grails-tika (=0.1.0), be.ugent.idlab.knows:dataio (>=1.2.0 <=1.3.1) +637 more potentially affected by CVE-2022-26336 via org.apache.poi:poi-scratchpad (>=3.8-beta1 <=5.2.0)

org.apache.poi:poi-scratchpad MAVEN version =3.8-beta1, =1.2.0, =1.3, =1.0.7, =1.0.7, =1.0.1, =0.0.4, =1.0.0, =1.0.0, =1.0.3 - cn.com.jeeweb:jeeweb-jwt =1.0.0 - cn.com.jeeweb:jeeweb-minio =1.0.0 and more Source cves: CVE-2022-26336 Source advisory: OSV:GHSA-MQVP-7RRG-9JXC...

ai.stainless:grails-tika (=0.1.0), au.com.turingg:turingg-files (=0.0.1) +616 more potentially affected by CVE-2022-23596 via com.github.junrar:junrar (>=0.7 <=7.4.0)

com.github.junrar:junrar MAVEN version =0.7, =3.6.1, =3.11.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1, =1.0.4 and more Source cves: CVE-2022-23596 Source advisory: OSV:GHSA-M6CJ-93V6-CVR5...

ai.stainless:grails-tika (=0.1.0), android.arch.navigation:navigation-safe-args-gradle-plugin (>=1.0.0 <=1.0.0-rc02) +2560 more potentially affected by CVE-2021-33813 via org.jdom:jdom2 (>=2.0.3 <=2.0.6)

org.jdom:jdom2 MAVEN version =2.0.3, =1.0.0, =1.2.0-alpha12, =1.2.0-alpha12, =1.2.0-alpha12, =1.2.0-alpha12, =1.1.0, =1.2.0-alpha12, =1.0.0, =2.4.0, =2.4.0, =2.0.0, =1.0.0-alpha01, =1.0...

ai.stainless:grails-tika (=0.1.0), au.com.turingg:turingg-files (=0.0.1) +1760 more potentially affected by CVE-2021-31811 via org.apache.pdfbox:pdfbox (>=2.0.0 <=2.0.23)

org.apache.pdfbox:pdfbox MAVEN version =2.0.0, =0.2.1, =0.5.0, =0.11.1, =1.0.0, =1.0, =1.3.5, =0.1.8, =1.1.7 - cc.drx:pdf2.13 =ee - cc.drx:poi2.13 =ee and more Source cves: CVE-2021-31811 Source advisory: OSV:GHSA-FG3J-Q579-V8X4...

'/WEB-INF/' Information Disclosure Vulnerability (HTTP)

Various application or web servers / products are prone to an information disclosure vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Man-in-the-Middle (MitM)

grails is vulnerable to man-in-the-middle attacks. The vunlerablity exits beacuse SDKman notification service is resolved over an insecure HTTP channel, which would potentially allow remote attackers to sniff or modify network traffic...

Internet Bug Bounty: Industry-Wide MITM Vulnerability Impacting the JVM Ecosystem

I've been exploring the industry-wide scope of the use of HTTP to resolve dependencies in build infrastructure across the industry. What I unearthed was that some of the most popular libraries and two compilers were impacted by this vulnerability. Vulnerability CWE-829: Inclusion of Functionality...

CVE-2019-12728

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP...

Design/Logic Flaw

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP...

CVE-2019-12728

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP...

CVE-2019-12728

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP...

CVE-2019-12728

CVE-2019-12728 affects Grails up to version 3.3.9, where the SDKMan notification service was resolved over cleartext HTTP. This creates a potential for eavesdropping or tampering of the notification channel, with impact on the confidentiality and integrity of the interaction during dependency res...

Directory traversal

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

CVE-2018-1000817

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

CVE-2018-1000817

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...