1690 matches found
CVE-2026-0603
CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injection ★ CVE-2026-0603 Hibernate SQL Injection PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Overview CVE-2026-0603 is a Second-Order SQL Injection vulnerability in Hibernate ORM , a widely used Ja...
hibernate-orm
Hibernate ORM is a library providing Object/Relational Mapping ORM support to applications, libraries, and frameworks. It also provides an implementation of the JPA specification, which is the standard Java specification for ORM. This is the repository of its source code: see Hibernate.org for...
hibernate__hibernate-validator_CVE-2019-10219_6-0-17-Final
Hibernate Validator Version: 6.0.17.Final - 13-06-2019 What is it? This is the reference implementation of JSR-380 - Bean Validation 2.0. Bean Validation defines a metadata model and API for JavaBean as well as method validation. The default metadata source are annotations, with the ability to...
XWiki - HQL Injection
XWiki is vulnerable to Hibernate Query Language HQL injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potential...
CVE-2026-0603
CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injection ★ CVE-2026-0603 Hibernate SQL Injection PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Overview CVE-2026-0603 is a Second-Order SQL Injection vulnerability in Hibernate ORM , a widely used Ja...
cve-2021-44228--spring-hibernate
CVE-2021-44228 POC - Spring / Hibernate This POC uses Spring / Hibernate, however a similar approach of rmi - deserialization could be used to trigger any deserialization vulnerability TL;DR $ docker-compose up $ curl -X POST -H 'Content-Type: text/plain' localhost:8080 --data-binary...
hibernate__hibernate-validator_CVE-2019-10219_6_0_18_Final_fixed
Hibernate Validator Version: 6.0.18.Final - 25-10-2019 What is it? This is the reference implementation of JSR-380 - Bean Validation 2.0. Bean Validation defines a metadata model and API for JavaBean as well as method validation. The default metadata source are annotations, with the ability to...
Security Bulletin: Hibernate Validator is affected by an expression language injection vulnerability (CVE-2026-93879)
Summary Hibernate Validator is affected by an expression language injection vulnerability. Vulnerability Details CVEID:CVE-2026-93879 DESCRIPTION: Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escapi...
Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
Summary IBM Enterprise Build of Quarkus is affected by the Hibernate Validator vulnerability Vulnerability Details CVEID:CVE-2026-93879 DESCRIPTION: Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper...
CLSA-2025-1758796886 kernel: Fix of 23 CVEs
drm/amd/amdgpu: introduce gcmes2.bin v2 - proc: fix a dentry lock race between releasetask and lookup - scsi: aacraid: Stop using PCIIRQAFFINITY - scsi: aacraid: Remove useless code - scsi: aacraid: Remove unused aaccheckhealth - scsi: aacraid: struct user,sgmap,64,raw: Replace 1-element arrays...
CVE-2026-111390: SQL Injection: Hibernate
Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/erupt. Attackers holding query permission on entities with String-keyed linkTre...
Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.33.4 release and security update
An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...
Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.6 release and security update
An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...
Astra Linux – vulnerability in linux-5.10, linux-5.15
In the Linux kernel, the following vulnerability has been resolved: nvdimm: Fix firmware activation deadlock scenarios Lockdep reports the following deadlock scenarios for CXL root devices: power-management, deviceprepare, operations, and deviceshutdown operations for ‘ndregion’ devices: Chain...
Astra Linux – vulnerability in linux-5.10, linux-6.1
In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: mask DAIF before restoring hibernated kernel The arm64 hibernate code manages exception masking in an improper manner, potentially leading to crashes or warnings during resume. When a hibernation image is saved ...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Only disable IRQ1 wakeup when i8042 actually enables it. The IRQ1 wakeup should be disabled only in cases where i8042 has actually enabled it. Otherwise, “wakedepth” for this IRQ will attempt to drop below...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: PM: hibernate: deferring device probing when resuming from hibernation syzbot is reporting a hung task at miscopen, due to a race condition involving the probecount variable. Currently, waitfordeviceprobe from snapshotopen and...
CVE-2026-90290
A flaw was found in the Linux kernel's hibernate functionality for arm64 architectures. When the system attempts to save memory tags during hibernation, a failure in this process can prevent the proper restoration of the Disable Asynchronous Interrupts and Fast interrupts DAIF state. This leaves...
CVE-2026-93879
A flaw was found in Hibernate Validator starting with version 5.4.1. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS by submitting specially crafted input containing unescaped message parameters. Improper escaping allows user-supplied data to be...
CVE-2026-94451
The Quarkus REST Data Panache component is vulnerable to information disclosure and denial of service (DoS) due to an unvalidated sort parameter . An attacker can exploit this flaw on certain endpoints to gain unauthorized access to information or force the database to perform complex tasks, pote...