Cross site scripting

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...

CVE-2019-15488

CVE-2019-15488 affects Ignite Realtime Openfire before 4.4.1, where the LDAP setup test endpoint processes input in a way that allows a reflected XSS payload. The issue is described as a reflected XSS via the LDAP setup test in multiple sources (Openfire, Red Hat advisory, OSV, etc.). No explicit...

CVE-2019-15488

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...

CVE-2019-4337

IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412...

Authentication flaw

IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412...

CVE-2019-4337

CVE-2019-4337 affects IBM Robotic Process Automation with Automation Anywhere (version 11). The IBM bulletin documents an information-disclosure vulnerability caused by missing authentication in Ignite cluster nodes, enabling an attacker to obtain sensitive information. CVSS details in the entry ...

CVE-2019-4337

IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412...

PT-2019-17039 · Automation Anywhere +1 · Automation Anywhere +1

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation with Automation Anywhere version 11 Description: The issue is related to missing authentication in Ignite nodes, which could allow an attacker to obtain sensitive information. Recommendations: For IBM Robotic...

Security Bulletin: IBM Robotic Process Automation Ignite Cluster Nodes are missing authentication (CVE-2019-4337)

Summary IBM Robotic Process Automation Ignite Cluster Nodes are missing authentication Vulnerability Details CVEID: CVE-2019-4337 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere could allow an attacker to obtain sensitive information due to missing authentication in Ignite...

org.apache.beam:beam-runners-twister2 (>=2.23.0 <=2.74.0), org.apache.ignite:ignite-mesos (>=2.7.0 <=2.12.0) +5 more potentially affected by CVE-2018-11793 via org.apache.mesos:mesos (=1.5.0)

org.apache.mesos:mesos MAVEN version =1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - org.apache.beam:beam-runners-twister2 =2.23.0, =2.7.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.8.0 Source cves:...

GHSA-2R5H-GH4X-8HP9 Resources Downloaded over Insecure Protocol in igniteui

Affected versions of igniteui download Javascript and CSS resources over an unencrypted HTTP connection. An attacker with a privileged network position can intercept and view or modify any content sent or recieved over an unencrypted HTTP connection. Recommendation The igniteui package has been...

Resources Downloaded over Insecure Protocol in igniteui

Affected versions of igniteui download Javascript and CSS resources over an unencrypted HTTP connection. An attacker with a privileged network position can intercept and view or modify any content sent or recieved over an unencrypted HTTP connection. Recommendation The igniteui package has been...

ignite: Improper deserialization allows for code execution via GridClientJdkMarshaller endpoint

In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be...

Moderate severity vulnerability that affects com.sparkjava:spark-core

In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark...

org.apache.beam:beam-runners-twister2 (>=2.23.0 <=2.74.0), org.apache.ignite:ignite-mesos (>=2.7.0 <=2.12.0) +5 more potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (=1.5.0)

org.apache.mesos:mesos MAVEN version =1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - org.apache.beam:beam-runners-twister2 =2.23.0, =2.7.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.8.0 Source cves:...

cn.youweisoft:sparrow-permission (>=1.4.0 <=1.6.0), com.bucket4j:bucket4j-ignite (>=7.6.1 <=8.10.1) +267 more potentially affected by CVE-2018-8018 via org.apache.ignite:ignite-core (>=1.0.0-RC1 <=2.5.0)

org.apache.ignite:ignite-core MAVEN version =1.0.0-RC1, =1.4.0, =7.6.1, =8.11.0, =8.11.0, =8.0.0, =1.0.0, =3.0.0-beta1, =0.1.2, =1.5.1, =2.0, =0.0.1, =1.1.0 - com.github.itzmedinesh:micro-cache-grid =1.0.0 and more Source cves: CVE-2018-8018 Source advisory: OSV:GHSA-QCJV-WFCG-MMPR...

GHSA-QCJV-WFCG-MMPR Code execution via deserialization in org.apache.ignite:ignite-core

Apache Ignite 2.5 and earlier serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a...

Code execution via deserialization in org.apache.ignite:ignite-core

Apache Ignite 2.5 and earlier serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a...

cn.youweisoft:sparrow-permission (>=1.4.0 <=1.6.0), com.bucket4j:bucket4j-ignite (>=7.6.1 <=8.10.1) +257 more potentially affected by CVE-2018-1295 via org.apache.ignite:ignite-core (>=1.0.0-RC1 <=2.3.0)

org.apache.ignite:ignite-core MAVEN version =1.0.0-RC1, =1.4.0, =7.6.1, =8.11.0, =8.11.0, =8.0.0, =1.0.0, =3.0.0-beta1, =0.9.1, =1.5.1, =2.0, =0.0.1, =1.0, =1.01 - com.github.rubanm:ignite-scala2.10 =0.0.1 and more Source cves: CVE-2018-1295 Source advisory: OSV:GHSA-CHP4-RV79-68J3...

Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one...