CVE-2021-21430

OpenAPI Generator contains a vulnerability where code generated for Java/Scala performs insecure temporary file creation via File.createTempFile, risking exposure of application/data when handling binary uploads/downloads. Affected generators include Java (jersey2, okhttp-gson default) and scala-...

CVE-2021-21430 Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code

OpenAPI Generator allows generation of API client libraries SDK generation, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data...

be.objectify:deadbolt-java_2.13 (=2.8.0), be.objectify:deadbolt-scala_2.13 (=2.8.0) +470 more potentially affected by CVE-2021-23339 via com.typesafe.akka:akka-http-core_2.13 (>=10.1.10 <=10.1.13)

com.typesafe.akka:akka-http-core2.13 MAVEN version =10.1.10, =0.1.2, =0.1.2, =0.2.0, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.2.0, =0.1.2, =0.1.2, =0.4.0, =0.4.0, =0.4.0, =0.5.1 and more Source cves: CVE-2021-23339 Source advisory: SNYK:JAVA-COMTYPESAFEAKKA-2315412...

ai.agnos:reactive-sparql_2.12 (>=0.3.0 <=0.3.1), ai.lum:odinson-rest-api_2.12 (>=0.3.1 <=0.5.0) +897 more potentially affected by CVE-2021-23339 via com.typesafe.akka:akka-http-core_2.12 (>=10.0.0-RC2 <=10.1.13)

com.typesafe.akka:akka-http-core2.12 MAVEN version =10.0.0-RC2, =0.3.0, =0.3.1, =0.4.0, =2.6.0, =2.6.0, =0.3.0, =0.1.0, =0.6.0, =0.1.9, =1.0.0-RC1 - ch.wavein:wi-play-mongo2.12 =1.6 - cn.playscala:play-reactive-mongo2.12 =0.1.0 and more Source cves: CVE-2021-23339 Source advisory:...

CVE-2021-21293

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

CVE-2021-21293

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

Design/Logic Flaw

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

Design/Logic Flaw

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0 <=0.6.0), com.47deg:embedded-cassandra-core_2.12 (=0.0.7) +146 more potentially affected by CVE-2021-21293 +1 more via org.http4s:blaze-core_2.12 (>=0.12.4 <=0.14.14)

org.http4s:blaze-core2.12 MAVEN version =0.12.4, =0.3.0, =0.22.0, =0.13.2, =0.2.6, =0.3.0, =0.18.1, =0.1.13, =0.1.13, =0.1.13, =0.1.13, =0.1.13, =0.1.13, =0.5.6 - com.azavea.geotrellis:geotrellis-stac-example2.12 =4.3.0 and more Source cves: CVE-2021-21293, CVE-2021-21294 Source advisory:...

CVE-2021-21294

The CVE-2021-21294 issue affects http4s-blaze-server (BlazeCore) where the server accepts connections unboundedly on its selector pool, potentially exhausting OS resources and undermining circuit breakers. Affected: http4s-blaze-server variants prior to 0.21.17, 0.22.0-M2, and 1.0.0-M14; underlyi...

CVE-2021-21294 Unbounded connection acceptance in http4s-blaze-server

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...

CVE-2021-21293

CVE-2021-21293 concerns blaze-core prior to 0.14.15, where unbounded acceptance of new connections on a dedicated thread pool can exhaust file handles and degrade services. Affected component is blaze-core (used by http4s-blaze-server) with unbounded queues after accept. The fix in 0.14.15 adds a...

Exploit for Path Traversal in Apache Flink

CVE-2020-17518 Apache Flink RESTful API Arbitrary File Upload...

Apache Flink suffers from an arbitrary file read vulnerability

Apache Flink is an open source distributed streaming data processing engine from the Apache Software Foundation. It is written primarily in Java and Scala languages. Apache Flink has an arbitrary file read vulnerability that can be exploited by an attacker to obtain sensitive information...

com.alejandrohdezma:http4s-munit-testcontainers_2.12 (>=0.2.0 <=0.6.3), com.alejandrohdezma:http4s-munit_2.12 (>=0.1.0 <=0.6.3) +3 more potentially affected by unknown CVE via org.http4s:http4s-async-http-client_2.12 (>=0.21.0-M6 <=0.21.25)

org.http4s:http4s-async-http-client2.12 MAVEN version =0.21.0-M6, =0.2.0, =0.1.0, =0.1.3, =0.1.3, =0.1.7 - org.scala-steward:scala-steward-core2.12 =0.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8HXH-R6F7-JF45...

GHSA-QV8Q-V995-72GR personnummer/csharp vulnerable to Improper Input Validation

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severity. Impact This vulnerability impacts...

ai.lum:odinson-rest-api_2.12 (>=0.2.0 <=0.2.3), ai.snips:play-mongo-bson_2.12 (>=0.4 <=0.5.1) +482 more potentially affected by CVE-2020-12480 via com.typesafe.play:play_2.12 (>=2.6.0-M1 <=2.7.4)

com.typesafe.play:play2.12 MAVEN version =2.6.0-M1, =0.2.0, =0.4, =0.4.0, =2.6.0, =2.6.0, =0.1.0, =0.3.0, =1.1.0, =1.3.0, =1.3.1 and more Source cves: CVE-2020-12480 Source advisory: OSV:GHSA-CF8J-64H9-6Q58...

com.dbrsn:universal-health-check-http4s_2.12 (=0.0.5), com.github.agourlay:cornichon-http-mock_2.12 (>=0.12.7 <=0.16.3) +36 more potentially affected by CVE-2020-5280 via org.http4s:http4s-server_2.12 (>=0.10.0-M10 <=0.18.25)

org.http4s:http4s-server2.12 MAVEN version =0.10.0-M10, =0.12.7, =0.0.3, =0.1.0-RC2, =0.5.2, =2.1.0, =2.2.0, =2.2.0, =2.2.0, =2.3.0, =2.2.0, =2.3.0, =2.2.2, =2.2.5 and more Source cves: CVE-2020-5280 Source advisory: OSV:GHSA-66Q9-F7FF-MMX6...

JetBrains Scala Plugin Encryption Issue Vulnerability

JetBrains Scala plugin is a language plugin from the Czech company JetBrains. A vulnerability with cryptographic issues exists in versions of JetBrains Scala plugin prior to 2019.2.1. An attacker can exploit the vulnerability to obtain sensitive information by sniffing network traffic...

CVE-2020-7907

In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections...