Server-Side Template Injection

conductor-core is vulnerable to server-side template injection. The vulnerability exists as it was using hibernate-validator in a custom constraint validator, where user-input that were not properly validated against a validation mapping configuration can reach the error message template, allowin...

Code injection

Netflix Titus uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passe...

PT-2020-20571 · Netflix +1 · Netflix Titus +2

Name of the Vulnerable Software and Affected Versions: Netflix Titus affected versions not specified Netflix Conductor affected versions not specified Description: The issue concerns the use of Java Bean Validation JSR 380 custom constraint validators in Netflix Titus and Netflix Conductor. When...

GHSA-XXGP-PCFC-3VGC Privilege Escalation in Hibernate Validator

In Hibernate Validator 5.2.x before 5.2.5.Final, 5.3.x before 5.3.6.Final, and 5.4.x before 5.4.2.Final, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege...

am.ik.home:uaa-server (>=1.0.0 <=1.2.0), at.porscheinformatik.zanata:common (>=4.7.0 <=4.7.8) +2713 more potentially affected by CVE-2017-7536 via org.hibernate:hibernate-validator (>=5.2.0.Alpha1 <=5.2.4.Final)

org.hibernate:hibernate-validator MAVEN version =5.2.0.Alpha1, =1.0.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =1, =1, =10 and more Source cves: CVE-2017-7536 Source advisory: OSV:GHSA-XXGP-PCFC-3VGC...

am.ik.home:uaa-server (>=1.3.0 <=1.9.0), au.com.cybernostics:theme-tree (=0.9.0) +1885 more potentially affected by CVE-2017-7536 via org.hibernate:hibernate-validator (>=5.3.0.Alpha1 <=5.3.5.Final)

org.hibernate:hibernate-validator MAVEN version =5.3.0.Alpha1, =1.3.0, =0.9.6, =0.0.1, =0.2.0, =1.0.3, =1.0.6, =0.2.1, =1.0.1, =1.2, =1.5 and more Source cves: CVE-2017-7536 Source advisory: OSV:GHSA-XXGP-PCFC-3VGC...

at.researchstudio.sat:won-owner-webapp (=0.3), at.yawk.dropwizard-nagios:dropwizard-nagios (=1.0) +716 more potentially affected by CVE-2017-7536 via org.hibernate:hibernate-validator (>=5.4.0.Beta1 <=5.4.1.Final)

org.hibernate:hibernate-validator MAVEN version =5.4.0.Beta1, =2.6.0, =2.6.0, =3.4.0, =3.6.0, =2.4, =3.5.0, =1.0.0.Final, =2.5.4, =0.8.0, =0.9.2 - com.arpnetworking:artemis2.11 =0.1.7 - com.bendb.dropwizard:dropwizard-jooq =1.2.0-0 and more Source cves: CVE-2017-7536 Source advisory:...

Privilege Escalation in Hibernate Validator

In Hibernate Validator 5.2.x before 5.2.5.Final, 5.3.x before 5.3.6.Final, and 5.4.x before 5.4.2.Final, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege...

Arbitrary Code Execution

class-validator is vulnerable to arbitrary code execution. The vulnerability exists due to the insecure defaults where the property of forbidUnknownValues is not set to true, allowing unknown objects from passing validation...

hibernate-validator: safeHTML validator allows XSS

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...

hibernate-validator: safeHTML validator allows XSS

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...

Important: Red Hat Security Advisory: Red Hat build of Thorntail 2.5.1 security and bug fix update

An update is now available for Red Hat build of Thorntail. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

EL Expression Injection

hibernate-validator is vulnerable to EL Expression Injection. The vulnerability exists as the value of modType in the validation message is improperly evaluated with $...

hibernate-validator input validation error vulnerability

Hibernate Validator is a parameter validation framework . An input validation error vulnerability exists in Hibernate Validator version 6.1.2.Final. The vulnerability stems from a networked system or product that does not properly validate input data. No details of the vulnerability are provided ...

CVE-2020-10693

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

CVE-2020-10693

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

DEBIAN-CVE-2020-10693

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

Input validation

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

CVE-2020-10693

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

UBUNTU-CVE-2020-10693

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...