SUSE CVE-2020-25724

A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected...

SUSE CVE-2023-0482

In RESTEasy the insecure File.createTempFile is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user...

CVE-2023-0482

In RESTEasy the insecure File.createTempFile is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user...

Resteasy 安全漏洞

Red Hat Resteasy is a JAX-RS a Java programming language API specification implementation from Red Hat. A security vulnerability exists in Resteasy that originates from allowing users to create insecure temporary files...

CVE-2023-0481

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user...

quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to SQL injection due to PostgreSQL (CVE-2022-31197) and obtaining sensitive information due to RESTEasy (CVE-2020-25633)

Summary IBM i Modernization Engine for Lifecycle Integration platform component is vulnerable to SQL injection and obtaining sensitive information as described in the Vulnerability Details section. These components are used in IBM i Modernization Engine for Lifecycle Integration for infrastructur...

resteasy: Error message exposes endpoint class information

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.7 security update

Red Hat Integration Camel Extensions for Quarkus 2.7 is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Moderate. A Common Vulnerability Scoring System CVSS base score, whic...

quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

br.com.labbs:quarkus-monitor (>=0.1.5 <=0.3.0), br.com.labbs:quarkus-monitor-deployment (>=0.1.5 <=0.3.0) +356 more potentially affected by CVE-2020-1695 via org.jboss.resteasy:resteasy-client (>=4.0.0.Beta1 <=4.5.9.Final)

org.jboss.resteasy:resteasy-client MAVEN version =4.0.0.Beta1, =0.1.5, =0.1.5, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =1.0.0, =1.0.0-alpha3 and more Source cves: CVE-2020-1695 Source advisory: OSV:GHSA-63CQ-PPQ8-CW6G...

GHSA-63CQ-PPQ8-CW6G Improper Input Validation in RESTEasy

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to...

at.porscheinformatik.zanata:common (>=4.7.0 <=4.7.8), at.porscheinformatik.zanata:stub-server (>=4.7.0 <=4.7.8) +516 more potentially affected by CVE-2020-1695 via org.jboss.resteasy:resteasy-client (>=3.0.0.Final <=3.11.5.Final)

org.jboss.resteasy:resteasy-client MAVEN version =3.0.0.Final, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =1.1.9, =1.0.0.Final, =1.0.3.Final and more Source cves: CVE-2020-1695 Source advisory: OSV:GHSA-63CQ-PPQ8-CW6G...

Improper Input Validation in RESTEasy

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to...

GHSA-XRH2-C3RM-35JR HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference

HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy...

HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference

HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy...

quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

new packages: resteasy

An update is available for resteasy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.0...

XML External Entity Reference in RESTEasy

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the 1 external-general-entities or 2 external-parameter-entities features, which allows remote attackers to conduct XML external entity XXE attacks via unspecified vectors...

biz.paluch.visualizr:visualizr (=1.0), com.adobe.api.platform:launchpad (>=1.1.11 <=1.2.1) +598 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (>=1.1.GA <=3.0.10.Final)

org.jboss.resteasy:resteasy-jaxrs MAVEN version =1.1.GA, =1.1.11, =1.1.11, =1.1.16, =1.0, =0.2.0, =0.2.0, =2.6.2, =1.0, =1.0, =1.0.5, =1.1.0, =1.1.1 - com.iorga:iraj-waw-analyzer =1.0.0 and more Source cves: CVE-2014-7839 Source advisory: OSV:GHSA-PC54-PCHM-XCW6...