CVE-2022-31018 Denial of service binding form from JSON in Play Framework

Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This can occur when using either the FormbindFromRequest method on a JSON request body or the...

CVE-2022-31018: Uncontrolled Resource Consumption

Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This can occur when using either the FormbindFromRequest method on a JSON request body or the...

CVE-2022-31023: Generation of Error Message Containing Sensitive Information

Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception stack trace. Play does this by...

CVE-2014-125001

A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended...

Remote code execution

A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended...

CVE-2014-125001 Cardo Systems Scala Rider Q3 Cardo-Updater api privileges management

A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended...

CVE-2014-125001

CVE-2014-125001 concerns Cardo Systems Scala Rider Q3. The vulnerability affects the Cardo-Updater component, specifically the "/cardo/api" file, enabling unauthenticated remote code execution with root privileges. Impact is described as complete compromise of confidentiality, integrity, and avai...

Cardo Systems Scala Rider Q3 安全漏洞

Cardo Systems Scala Rider Q3 is a new Bluetooth headset from Cardo by Cardo Systems. A security vulnerability exists in Cardo Systems Scala Rider Q3, which can be exploited by an attacker to execute unauthenticated remote code using root privileges...

PT-2022-7761

Name of the Vulnerable Software and Affected Versions Cardo Systems Scala Rider Q3 affected versions not specified Description A critical issue has been discovered, allowing unauthenticated remote code execution with root permissions. This is related to the file /cardo/api of the Cardo-Updater...

CVE-2014-125001: Improper Privilege Management

A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended...

Insufficient Data Verification in io.really:jwt-scala

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token...

GHSA-9PXM-8G95-Q5XR Insufficient Data Verification in io.really:jwt-scala

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token...

CVE-2022-28355

CVE-2022-28355 concerns Scala.js prior to 1.10.0, where randomUUID generates predictable values due to insecure encryption in the randomUUID implementation. The vulnerability affects Scala.js’s code generation/runtime relying on UUID generation. The publicly documented fix is to upgrade to Scala....

CVE-2021-41084

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...

CVE-2021-41084

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...

CVE-2021-41084

The CVE-2021-41084 issue affects http4s, where untrusted input in header names, header values, status reason phrases, URI paths, or URI registered names can enable response-splitting or request-splitting attacks. The vulnerability spans affected http4s versions up to 0.21.x and is fixed in 0.21.3...

CVE-2021-41084 Response Splitting from unsanitized headers in http4s

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...

CVE-2021-39185

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

CVE-2021-39185

Http4s is affected by a vulnerability in the default CORS configuration that enables origin reflection and a Null Origin Attack for versions 0.21.26 and prior, 0.22.0–0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24. The issue stems from the default CORS settings allowing credentialed acces...

CVE-2021-32643

Http4s is a Scala interface for HTTP services. StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns FNone, indicating no resource, if url.getFile is a...