MAL-2025-22507 Malicious code in holography-entanglement-ignite-chalk (npm)

The package holography-entanglement-ignite-chalk was found to contain malicious code...

MAL-2025-37899 Malicious code in update-venus-ignite-bioinformatics (npm)

The package update-venus-ignite-bioinformatics was found to contain malicious code...

MAL-2025-15080 Malicious code in australis-primatology-ignite-markdown (npm)

The package australis-primatology-ignite-markdown was found to contain malicious code...

MAL-2025-31492 Malicious code in radiometric-ignite-tachyon-titan (npm)

The package radiometric-ignite-tachyon-titan was found to contain malicious code...

MAL-2025-18334 Malicious code in despina-ignite-perseus-webpack (npm)

The package despina-ignite-perseus-webpack was found to contain malicious code...

MAL-2025-33098 Malicious code in shimmer-ignite-jtc896-project (npm)

The package shimmer-ignite-jtc896-project was found to contain malicious code...

MAL-2025-24351 Malicious code in kaus-pavo-grus-ignite (npm)

The package kaus-pavo-grus-ignite was found to contain malicious code...

MAL-2025-31088 Malicious code in quantum-ignite-astro-cassini (npm)

The package quantum-ignite-astro-cassini was found to contain malicious code...

Connect with the security community at Microsoft Ignite 2025

In today’s AI-powered world, security professionals are facing unprecedented challenges—and opportunities. As generative AI reshapes the digital landscape, the need for robust, intelligent, and adaptive security strategies has never been more urgent. At Microsoft Ignite 2025, we will showcase...

Connect with the security community at Microsoft Ignite 2025

In today’s AI-powered world, security professionals are facing unprecedented challenges—and opportunities. As generative AI reshapes the digital landscape, the need for robust, intelligent, and adaptive security strategies has never been more urgent. At Microsoft Ignite 2025, we will showcase...

VulnCheck KEV: CVE-2020-10650

A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and...

CVE-2024-25421

An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOMCACHE component...

CVE-2024-25420

An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component...

CVE-2020-12772

An issue was discovered in Ignite Realtime Spark 2.8.3 and the ROAR plugin for it on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the NTLM hashes of the user are sent with the HTTP request. Th...

CVE-2020-35199

Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS...

CVE-2020-35200

Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS...

CVE-2020-35127

Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS...

CVE-2019-18393

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability...

The vulnerability of distributed databases for high-performance computations with Apache Ignite, related to deserialization mechanism flaws, allows attackers to execute arbitrary code.

The vulnerability of distributed databases for high-performance Apache Ignite calculations is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Remote Code Execution (RCE)

Apache Ignite is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper deserialization due to the configured Class Serialization Filters being ignored for some Ignite endpoints, allowing an attacker to send a maliciously crafted message that executes arbitrary code on the...