hibernate__hibernate-validator_CVE-2019-10219_6_0_18_Final_fixed

Hibernate Validator 版本：6.0.18.Final - 2019-10-25 这是什么？ 这是 JSR-380 - Bean Validation 2.0 的参考实现。 Bean Validation 定义了用于 JavaBean 以及方法验证的元数据模型和 API。 默认元数据来源是注解，但可以通过使用 XML 验证描述符来覆盖和扩展元数据。 文档 此版本的文档包含在发行包的 docs 目录中，或可在线访问。 发行说明 此版本的完整变更列表可在 changelog.txt 中找到。 系统要求 JDK 1.8 或更高版本。 使用 Hibernate Validator...

hibernate__hibernate-validator_CVE-2019-10219_6-0-17-Final

Hibernate Validator Version: 6.0.17.Final - 13-06-2019 What is it? This is the reference implementation of JSR-380 - Bean Validation 2.0. Bean Validation defines a metadata model and API for JavaBean as well as method validation. The default metadata source are annotations, with the ability to...

CVE-2020-9297

Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary...

CVE-2020-9297

CVE-2020-9297 affects Netflix Titus prior to v0.1.1-rc.274. The issue arises when building custom constraint violation messages with ConstraintValidatorContext.buildConstraintViolationWithTemplate(); an attacker could inject arbitrary data into the error message template, enabling execution of ar...

CVE-2020-9296

CVE-2020-9296 affects Netflix Titus and Netflix Conductor through Java Bean Validation (JSR 380) custom constraint validators. The issue arises when building constraint violation messages via ConstraintValidatorContext.buildConstraintViolationWithTemplate(): attacker-controlled data in the templa...

Remote code execution

A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution RCE vulnerability. Apache Syncope uses Java Bean Validation JSR 380 custom constraint validators. When...