com.orientechnologies:orientdb-client (1.7.4), com.orientechnologies:orientdb-community (1.7.4) +7 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.7.4)

com.orientechnologies:orientdb-core MAVEN version 1.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - com.orientechnologies:orientdb-client 1.7.4 - com.orientechnologies:orientdb-community...

com.orientechnologies:orientdb (1.1.0), com.orientechnologies:orientdb-client (1.1.0) +10 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.1.0)

com.orientechnologies:orientdb-core MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - com.orientechnologies:orientdb 1.1.0 - com.orientechnologies:orientdb-client 1.1.0 -...

com.orientechnologies:orientdb-client (1.7-rc2), com.orientechnologies:orientdb-distributed (1.7-rc2) +5 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.7-rc2)

com.orientechnologies:orientdb-core MAVEN version 1.7-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - com.orientechnologies:orientdb-client 1.7-rc2 -...

com.orientechnologies:orientdb-client (1.7.3), com.orientechnologies:orientdb-community (1.7.3) +6 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.7.3)

com.orientechnologies:orientdb-core MAVEN version 1.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - com.orientechnologies:orientdb-client 1.7.3 - com.orientechnologies:orientdb-community...

com.orientechnologies:orientdb-client (1.7.5), com.orientechnologies:orientdb-community (1.7.5) +6 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.7.5)

com.orientechnologies:orientdb-core MAVEN version 1.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - com.orientechnologies:orientdb-client 1.7.5 - com.orientechnologies:orientdb-community...

com.orientechnologies:orientdb (1.5.1), com.orientechnologies:orientdb-client (1.5.1) +9 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.5.1)

com.orientechnologies:orientdb-core MAVEN version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - com.orientechnologies:orientdb 1.5.1 - com.orientechnologies:orientdb-client 1.5.1 -...

com.countvajhula:pilot (1.0), com.orientechnologies:orientdb (1.0) +5 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.0)

com.orientechnologies:orientdb-core MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - com.countvajhula:pilot 1.0 - com.orientechnologies:orientdb 1.0 -...

br.com.ingenieux:jbake-maven-plugin (0.0.7), com.orientechnologies:orientdb-client (1.6.2) +9 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.6.2)

com.orientechnologies:orientdb-core MAVEN version 1.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - br.com.ingenieux:jbake-maven-plugin 0.0.7 - com.orientechnologies:orientdb-client 1.6.2 -...

com.orientechnologies:orientdb-client (1.7.9), com.orientechnologies:orientdb-community (1.7.9) +8 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.7.9)

com.orientechnologies:orientdb-core MAVEN version 1.7.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - com.orientechnologies:orientdb-client 1.7.9 - com.orientechnologies:orientdb-community...

com.orientechnologies:orientdb-client (1.7.1), com.orientechnologies:orientdb-community (1.7.1) +6 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.7.1)

com.orientechnologies:orientdb-core MAVEN version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - com.orientechnologies:orientdb-client 1.7.1 - com.orientechnologies:orientdb-community...

com.orientechnologies:orientdb-client (1.7.6), com.orientechnologies:orientdb-community (1.7.6) +7 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.7.6)

com.orientechnologies:orientdb-core MAVEN version 1.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - com.orientechnologies:orientdb-client 1.7.6 - com.orientechnologies:orientdb-community...

com.orientechnologies:orientdb (1.0.1), com.orientechnologies:orientdb-client (1.0.1) +6 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.0.1)

com.orientechnologies:orientdb-core MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - com.orientechnologies:orientdb 1.0.1 - com.orientechnologies:orientdb-client 1.0.1 -...

ai.grakn:grakn-orientdb-factory (>=0.7.0, <=0.10.0), ai.grakn:orientdb-factory (>=0.11.0, <=0.16.0) +106 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (>=2.0-m1, <=2.2.22)

com.orientechnologies:orientdb-core MAVEN version =2.0-m1, =0.7.0, =0.11.0, =0.0.1, =0.8, =0.1, =0.1, =0.4, =3.0.0.m1, =0.12, =0.12, =2.0-m1, =2.0.2, =2.0-m1, =2.0-m1, =2.2.0-beta and more Source cves: CVE-2017-11467 Source advisory: GHSA-XM6R-4466-MR74...

OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request...

com.orientechnologies:orientdb (1.3.0), com.orientechnologies:orientdb-client (1.3.0) +16 more potentially affected by CVE-2017-11467 via com.orientechnologies:orientdb-core (1.3.0)

com.orientechnologies:orientdb-core MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-core and may be impacted: - com.orientechnologies:orientdb 1.3.0 - com.orientechnologies:orientdb-client 1.3.0 -...

Arbitrary File Write

orientdb-core is vulnerable to arbitrary file writes. The application does not properly check on the file path during extraction, allowing arbitrary files to be written in other directories...

Arbitrary File Write

orientdb is vulnerable to arbitrary file write. The application does not properly validate the destination filepath during compressed file extraction, allowing a malicious user to overwrite files in the target directory...

WS-2018-0128

OrientDB prior to version 3.0.2 is vulnerable to path traversal issue in archive extraction. Attacker can exploit this issue via a specially crafted archive that holds directory traversal filenames to execute arbitrary code on the affected system...

OrientDB Groovy Wrapper Remote Code Execution (CVE-2017-11467)

A remote code execution vulnerability exists in OrientDB server. The vulnerability is due privilege escalation when the server receives a specially crafted request. A remote attacker can exploit this vulnerability to gain privilege rights and execute arbitrary code...

VulnCheck KEV: CVE-2017-11467

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request...