Scala Stream Collector 安全漏洞

Scala Stream Collector is a Snowplow open source collector for cloud-native web, mobile and event analytics. A security vulnerability exists in Scala Stream Collector versions prior to 3.3.0, which stems from the fact that sending an oversized load may cause the service to become unavailable...

CVE-2021-39185

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

GHSA-P953-3J66-HG45 vulnerabilities

Vulnerabilities for packages: spark-scala-2.13...

GHSA-P953-3J66-HG45 vulnerabilities

Vulnerabilities for packages: spark-scala-2.13...

CVE-2024-23953 vulnerabilities

Vulnerabilities for packages: spark-scala-2.13...

CVE-2024-23953 vulnerabilities

Vulnerabilities for packages: spark-scala-2.13...

Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8

Summary Third party reported 'Stored XSS' and 'CSRF' issues, Apache Tomcat, Apache ActiveMQ, CKEditor, libcURL, xmlbeans, scala-library, json-smart, jna-platform, jackson-databind, commons-io, shiro-core, commons-net, snappy-java, xercesImpl are identified as vulnerable components with multiple...

Moderate: Red Hat Security Advisory: Red Hat AMQ Streams 2.5.2 release and security update

Red Hat AMQ Streams 2.5.2 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

africa.absa:inception-application (>=1.0.0 <=1.2.0), app.fmgp:scala-did-docs_3 (>=0.1.0-M16 <=0.1.0-M33) +3383 more potentially affected by CVE-2024-3653 via io.undertow:undertow-core (>=1.0.0.Alpha1 <=2.2.33.Final)

io.undertow:undertow-core MAVEN version =1.0.0.Alpha1, =1.0.0, =0.1.0-M16, =1.0.0, =0.4.0, =2.0.0, =1.0.2, =1.0.0, =1.2.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2024-3653 Source advisory: OSV:GHSA-CH7Q-GPFF-H9HP...

IBM Engineering Requirements Management DOORS 9.7.2.x < 9.7.2.8 Multiple Vulnerabilities (7124058)

The version of IBM Engineering Requirements Management DOORS formerly IBM Rational DOORS installed on the remote host is 9.7.2.x prior to 9.7.2.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 7124058 advisory. - Apache Shiro before 1.9.1, A RegexRequestMatcher can b...

Fedora: Security Advisory for scala (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: scala-2.13.12-7.fc40

Scala is a general purpose programming language designed to express common programming patterns in a concise, elegant, and type-safe way. It smoothly integrates features of object-oriented and functional languages. It is also fully interoperable with Java. This package contains the Scala compiler...

Stack overflow

Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn't checked, and queries with cyclic fragments...

CVE-2023-50730 Grackle has StackOverflowError in GraphQL query processing

Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn't checked, and queries with cyclic fragments...

CVE-2023-50730

CVE-2023-50730 affects Grackle, a Scala GraphQL server. The vulnerabilities arise from two stack-related issues: (1) cyclic GraphQL fragments could trigger a JVM StackOverflowError during type checking/compilation, and (2) the cats-parse recursive operator used in the parser isn’t stack-safe, ena...

CVE-2023-50730 Grackle has StackOverflowError in GraphQL query processing

Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn't checked, and queries with cyclic fragments...

org.typelevel:grackle-circe_native0.4_2.13 (>=0.15.0 <=0.17.2), org.typelevel:grackle-generic_native0.4_2.13 (>=0.15.0 <=0.17.2) +2 more potentially affected by CVE-2023-50730 via org.typelevel:grackle-core_native0.4_2.13 (>=0.15.0 <=0.17.2)

org.typelevel:grackle-corenative0.42.13 MAVEN version =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.17.2 Source cves: CVE-2023-50730 Source advisory: OSV:GHSA-G56X-7J6W-G8R8...

edu.gemini:gsp-graphql-circe_sjs1_2.13 (>=0.13.0 <=0.14.0), edu.gemini:gsp-graphql-generic_sjs1_2.13 (>=0.13.0 <=0.14.0) +2 more potentially affected by CVE-2023-50730 via edu.gemini:gsp-graphql-core_sjs1_2.13 (>=0.13.0 <=0.14.0)

edu.gemini:gsp-graphql-coresjs12.13 MAVEN version =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.14.0 Source cves: CVE-2023-50730 Source advisory: OSV:GHSA-G56X-7J6W-G8R8...

org.typelevel:grackle-circe_sjs1_2.13 (>=0.15.0 <=0.17.2), org.typelevel:grackle-generic_sjs1_2.13 (>=0.15.0 <=0.17.2) +2 more potentially affected by CVE-2023-50730 via org.typelevel:grackle-core_sjs1_2.13 (>=0.15.0 <=0.17.2)

org.typelevel:grackle-coresjs12.13 MAVEN version =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.17.2 Source cves: CVE-2023-50730 Source advisory: OSV:GHSA-G56X-7J6W-G8R8...

SUSE CVE-2023-46122

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorizedkeys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however...