com.github.jinahya:jsonrpc-bind-tests (0.7.1), org.amebastack.container:ameba-container-grizzly (>=0.1.6c, <=0.1.6e) +185 more potentially affected by CVE-2025-35036 via org.hibernate.validator:hibernate-validator (>=7.0.0.alpha1, <=7.0.0.alpha6)

org.hibernate.validator:hibernate-validator MAVEN version =7.0.0.alpha1, =0.1.6c, =0.1.2, =0.1.2, =0.1.2, =0.1.6c, =3.0.0-m2, =3.0.0-m2, =3.0.0-m2, =3.0.0-m2, =3.0.0 and more Source cves: CVE-2025-35036 Source advisory: MEND:CVE-2025-35036...

CVE-2025-35036

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as ...

CVE-2025-35036 hibernate-validator insecure default Expression Language interpolation

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as ...

CVE-2025-35036

CVE-2025-35036 affects Hibernate Validator prior to 6.2.0 and 7.0.0, where user-supplied input may be interpolated into constraint violation messages via Expression Language. This can lead to information disclosure or arbitrary Java code execution. The issue is mitigated in 6.2.0+ and 7.0.0+ by s...

Hibernate Validator security vulnerabilities

Hibernate Validator is a parameter validation framework from Hibernate. A security vulnerability exists in Hibernate Validator versions prior to 6.2.0 and prior to 7.0.0, which stems from user input interpolation in a constraint violation message, and could lead to the disclosure of sensitive...

CVE-2025-35036: Improper Control of Generation of Code

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as ...

PT-2025-23663 · Hibernate +3 · Hibernate Validator +3

CVE-2025-35036 Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expres… https://t.co/002YgA2hEa...

Looking for Attention: Randomized Attention Test Design for Validator Monitoring in Optimistic Rollups

Optimistic Rollups ORUs significantly enhance blockchain scalability but inherently suffer from the verifier's dilemma, particularly concerning validator attentiveness. Current systems lack mechanisms to proactively ensure validators are diligently monitoring L2 state transitions, creating a...

The Cost of Restaking Vs. Proof-Of-Stake

We compare the efficiency of restaking and Proof-of-Stake PoS protocols in terms of stake requirements. First, we consider the sufficient condition for the restaking graph to be secure. We show that the condition implies that it is always possible to transform such a restaking graph into secure P...

MAL-2025-4437 Malicious code in hibernate-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ba5c88bd8432cb5249a0abdf018e4b4c5da5068923a451703ae35d409b16414 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hibernate-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ba5c88bd8432cb5249a0abdf018e4b4c5da5068923a451703ae35d409b16414 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in hibernate-validator

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2024-11463

The DeBounce Email Validator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'from', 'to', and 'key' parameters in all versions up to, and including, 5.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2023-38875

A reflected cross-site scripting XSS vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'validator' parameter in '/reset-password'...

CVE-2022-47924

An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions 0.1.0 wich can result in arbitrary code execution and DoS once the users triggers the validation...

CVE-2021-43114

FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation...

CVE-2021-42764

The Proof-of-Stake PoS Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service delayed consensus decisions, and also increase the profits of individual validators, via short-range reorganizations of the underlying consensus chain...

CVE-2020-16163

An issue was discovered in RIPE NCC RPKI Validator 3.x before 3.1-2020.07.06.14.28. RRDP fetches proceed even with a lack of validation of a TLS HTTPS endpoint. This allows remote attackers to bypass intended access restrictions, or to trigger denial of service to traffic directed to co-dependent...

CVE-2020-16164

An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation ".roa" files or X509...

CVE-2020-16162

An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. Missing validation checks on CRL presence or CRL staleness in the X509-based RPKI certificate-tree validation procedure allow remote attackers to bypass intended access restrictions by using revoked certificates...