Man-in-the-Middle (MitM)

grails is vulnerable to man-in-the-middle attacks. The vunlerablity exits beacuse SDKman notification service is resolved over an insecure HTTP channel, which would potentially allow remote attackers to sniff or modify network traffic...

Internet Bug Bounty: Industry-Wide MITM Vulnerability Impacting the JVM Ecosystem

I've been exploring the industry-wide scope of the use of HTTP to resolve dependencies in build infrastructure across the industry. What I unearthed was that some of the most popular libraries and two compilers were impacted by this vulnerability. Vulnerability CWE-829: Inclusion of Functionality...

Design/Logic Flaw

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP...

CVE-2019-12728

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP...

CVE-2019-12728

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP...

CVE-2019-12728

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP...

CVE-2019-12728

CVE-2019-12728 affects Grails up to version 3.3.9, where the SDKMan notification service was resolved over cleartext HTTP. This creates a potential for eavesdropping or tampering of the notification channel, with impact on the confidentiality and integrity of the interaction during dependency res...

Directory traversal

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

CVE-2018-1000817

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

CVE-2018-1000817

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

CVE-2018-1000817

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

CVE-2018-1000817

The CVE affects the Asset Pipeline Grails Plugin. Vulnerable in versions prior to 2.14.1.1 (Grails 2.x), 2.15.1 (Grails 3/Java 7) and 3.0.6 (Grails 3/Java 8) where an Incorrect Access Control flaw enables directory traversal via a crafted GET request from the assets-pipeline context, allowing dow...

GHSA-Q25J-GCMV-5QPP Stored Cross Site Scripting in Grails Fields Plugin

Grails Fields plugin version 2.2.7 contains a Cross Site Scripting XSS vulnerability in using the display tag that can result in XSS. This vulnerability has been fixed in version 2.2.8...

Stored Cross Site Scripting in Grails Fields Plugin

Grails Fields plugin version 2.2.7 contains a Cross Site Scripting XSS vulnerability in using the display tag that can result in XSS. This vulnerability has been fixed in version 2.2.8...

Asset Pipeline Catalog Traversal Vulnerability

Grails is the Grails project to develop a set of Groovy-based programming language and for rapid development of Web applications and open source frameworks . Asset Pipeline plugin is used in one of the plug-ins used to deal with static resources . Grails Asset Pipeline plugin version 3.0.4 before...

CVE-2018-17605

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in...

CVE-2018-17605

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in...

Directory traversal

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in...

CVE-2018-17605

CVE-2018-17605 affects the Asset Pipeline plugin for Grails (versions before 3.0.4). A directory traversal flaw exists when a servlet-based application runs in Jetty, due to a classloader vulnerability that enables a reverse file traversal path via AssetPipelineFilter.groovy or AssetPipelineFilte...

CVE-2018-17605

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in...