45 matches found
Remote Code Execution (RCE) vulnerability in dropwizard-validation
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. Summary A server-side template injection...
9CVSS2.2AI score0.0309EPSS
SaveExploits1References11Affected Software1
Design/Logic Flaw
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection...
6.5CVSS7AI score0.0175EPSS
SaveExploits2References2Affected Software1
CVE-2018-16621
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection...
7.2CVSS6.9AI score
SaveExploits0References2
20