PT-2024-11944 · Unknown +1 · Hibernate Validator +1

Name of the Vulnerable Software and Affected Versions: hibernate-validator affected versions not specified Description: A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by...

CVE-2023-1932

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or...

Cross-site Scripting (XSS)

Overview org.hibernate:hibernate-validator is a Hibernate Validator Engine Relocation Artifact. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the isValid method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can...

Hibernate Validator Security Vulnerability

Hibernate Validator is a parameter validation framework from Hibernate. A security vulnerability exists in Hibernate Validator that stems from the fact that browsers may render invalid html...

hibernate-validator:MappingParserFuzzer: Security exception in com.code_intelligence.jazzer.sanitizers.ServerSideRequestForgery.checkSsrf

Detailed Report: https://oss-fuzz.com/testcase?key=5582152087437312 Project: hibernate-validator Fuzzing Engine: libFuzzer Fuzz Target: MappingParserFuzzer Job Type: libfuzzerasanhibernate-validator Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

The vulnerability of the SafeHtml validator in the Hibernate Validator library allows attackers to perform cross-site scripting attacks.

The vulnerability in the SafeHtml validator of the Hibernate Validator library relates to the lack of measures taken to protect the structure of web pages during the processing of HTML content. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

Security Bulletin: Vulnerability in Hibernate Validator affects Liberty for Java for IBM Cloud (CVE-2020-10693)

Summary There is a vulnerability in the Hibernate Validator library used by WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2020-10693 DESCRIPTION: Hibernate Hibernate Validator could allow a remote attacker to bypass security restrictions, caused by a flaw in the message...

Security Bulletin: Vulnerability in Hibernate Validator may affect IBM WebSphere Application Server Liberty shipped with IBM Digital Business Automation Workflow family products (CVE-2020-10693)

Summary WebSphere Application Server Liberty is shipped as part of the optional components Process Federation Server since 8.5.6, and User Management Service since 18.0.0.1 in IBM Business Automation Workflow and IBM Business Process Manager. Information about security vulnerabilities affecting I...

Security Bulletin:IBM TRIRIGA discloses CVE-2019-10219

Summary IBM TRIRIGA discloses CVE-2019-10219 Vulnerability Details CVEID:CVE-2019-10219 DESCRIPTION: Hibernate-Validator is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the SafeHtml validator annotation A remote attacker could exploit this...

Security Bulletin: Due to use of Hibernate Validator version 6.1.2.Final IBM Tivoli Network Manager is vulnerable which allows attackers to bypass input sanitation (escaping, stripping) controls(CVE-2020-10693, CVE-2019-10219).

Summary A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put i...

Improper Authentication in Hibernate Validator

ReflectionHelper org.hibernate.validator.util.ReflectionHelper in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager JSM restrictions and execute restricted reflection calls via a crafted application...

GHSA-845H-985R-JRQH Improper Authentication in Hibernate Validator

ReflectionHelper org.hibernate.validator.util.ReflectionHelper in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager JSM restrictions and execute restricted reflection calls via a crafted application...

OESA-2021-1332 hibernate-validator security update

This is the reference implementation of JSR-349 - Bean Validation 1.1. Bean Validation defines a meta-data model and API for JavaBean as well as method validation. The default meta-data source are annotations, with the ability to override and extend the meta-data through the use of XML validation...

hibernate-validator: Improper input validation in the interpolation of constraint error messages

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

Improper Input Validation in Hibernate Validator

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

GHSA-RMRM-75HP-PHR2 Improper Input Validation in Hibernate Validator

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

OESA-2021-1138 hibernate-validator security update

This is the reference implementation of JSR-349 - Bean Validation 1.1. Bean Validation defines a meta-data model and API for JavaBean as well as method validation. The default meta-data source are annotations, with the ability to override and extend the meta-data through the use of XML validation...

Security Bulletin: Rational Asset Analyzer is affected by a vulnerability in WebSphere Application Server Liberty (CVE-2020-10693)

Summary Rational Asset Analyzer team has addressed the following vulnerability: CVE-2020-10693. Vulnerability Details CVEID: CVE-2020-10693 DESCRIPTION: Hibernate Hibernate Validator could allow a remote attacker to bypass security restrictions, caused by a flaw in the message interpolation...

Security Bulletin: Vulnerability in WebSphere Application Server Liberty affects IBM Z Development and Test Environment - Jan 2021

Summary There is a vulnerability in WebSphere Application Server Liberty that is used by IBM Z Development and Test Environment. The issue affects WebSphere Application Server Liberty 17.0.0.3 - 20.0.0.10 using the beanValidation-2.0 feature. Vulnerability Details CVEID: CVE-2020-10693 DESCRIPTIO...

Security Bulletin: Multiple Security Vulnerabilities Affect IBM WebSphere Application Server in IBM Cloud

Summary There are multiple security vulnerabilities that affect the IBM WebSphere Application Server in the IBM Cloud. WebSphere Application Server Admin Console is vulnerable to cross-site scripting. WebSphere Application Server Liberty is vulnerable to a denial of service. WebSphere Application...