Improper Output Neutralization for Logs

Overview io.quarkus:quarkus-vertx-http is a Cloud Native, Linux Container First framework for writing Java applications. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in the HTTP access logs with long pattern when the logging format is set to a verbos...

Important: Red Hat Security Advisory: Red Hat Integration Camel K 1.10.2 release security update

Red Hat Integration Camel K 1.10.2 release and security update is now available. Red Hat Product Security has rated this update as having an impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0 <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0 <=0.2.0) +1900 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-vertx-http (>=3.0.0.Alpha1 <=3.2.5.Final)

io.quarkus:quarkus-vertx-http MAVEN version =3.0.0.Alpha1, =0.1.0, =0.1.0, =0.0.2, =0.1.1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.10 and more Source cves: CVE-2023-4853 Source advisory: OSV:GHSA-4F4R-WGV2-JJVG...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (=1.2.0), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (=1.2.0) +240 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-vertx-http (>=3.3.0 <=3.3.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.3.0, =0.0.10, =1.8.1, =1.8.1, =1.8.6, =1.8.6, =1.9.0, =1.9.0, =1.10.1, =1.10.1, =1.10.3 and more Source cves: CVE-2023-4853 Source advisory: OSV:GHSA-4F4R-WGV2-JJVG...

br.com.labbs:quarkus-monitor (>=0.1.5 <=0.3.0), br.com.labbs:quarkus-monitor-deployment (>=0.1.5 <=0.3.0) +1653 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-vertx-http (>=0.23.0 <=2.16.10.Final)

io.quarkus:quarkus-vertx-http MAVEN version =0.23.0, =0.1.5, =0.1.5, =1.0.2, =1.0.2, =1.0.2, =1.3.2, =1.0.132, =1.0.132, =1.0.133, =1.0.42, =1.0.42, =1.0.42, =1.3.2, =1.5.1 and more Source cves: CVE-2023-4853 Source advisory: OSV:GHSA-4F4R-WGV2-JJVG...

Cross-site Scripting (XSS)

quarkus-vertx-http is vulnerable to Cross-site Scripting XSS. The vulnerability exists because the library's form authentication session cookie path attribute is set to /, which allows an attacker to redirect malicious URLs, resulting in information disclosure...

br.com.labbs:quarkus-monitor (>=0.1.5 <=0.3.0), br.com.labbs:quarkus-monitor-deployment (>=0.1.5 <=0.3.0) +1517 more potentially affected by CVE-2023-0044 via io.quarkus:quarkus-vertx-http (>=0.23.0 <=2.13.6.Final)

io.quarkus:quarkus-vertx-http MAVEN version =0.23.0, =0.1.5, =0.1.5, =1.0.2, =1.0.2, =1.0.2, =1.0.132, =1.0.132, =1.0.133, =1.0.42, =1.0.42, =1.0.42, =1.0.22, =1.0.22, =1.0.30 and more Source cves: CVE-2023-0044 Source advisory: OSV:GHSA-C57V-HC7M-8PX2...

Red Hat quarkus-vertx-http 跨站脚本漏洞

Red Hat quarkus-vertx-http is a toolkit for building reactive applications from Red Hat USA. A security vulnerability exists in Red Hat quarkus-vertx-http. An attacker could exploit the vulnerability to perform a cross-site scripting attack, which could lead to information disclosure...

br.com.labbs:quarkus-monitor (>=0.1.5 <=0.3.0), br.com.labbs:quarkus-monitor-deployment (>=0.1.5 <=0.3.0) +1513 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (>=0.23.0 <=2.13.4.Final)

io.quarkus:quarkus-vertx-http MAVEN version =0.23.0, =0.1.5, =0.1.5, =1.0.2, =1.0.2, =1.0.2, =1.0.132, =1.0.132, =1.0.133, =1.0.42, =1.0.42, =1.0.42, =1.0.22, =1.0.22, =1.0.30 and more Source cves: CVE-2022-4147 Source advisory: OSV:GHSA-9895-G6X5-XWCP...

com.abavilla:fpi-bot-api (>=1.2.0 <=1.4.2), com.abavilla:fpi-bot-api-core (>=1.2.0 <=1.3.1) +696 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (>=2.14.0.CR1 <=2.14.1.Final)

io.quarkus:quarkus-vertx-http MAVEN version =2.14.0.CR1, =1.2.0, =1.2.0, =1.2.0, =1.3.2, =1.5.0, =1.5.0, =1.2.1, =1.2.1, =1.2.1, =1.3.2, =1.2.0, =1.2.0, =1.2.0, =1.3.3, =1.4.1 - com.abavilla:fpi-meta-plugin =1.0.19 and more Source cves: CVE-2022-4147 Source advisory: OSV:GHSA-9895-G6X5-XWCP...

Quarkus 安全漏洞

Quarkus is a cloud-native Linux container-first framework for writing Java applications. A security vulnerability exists in Quarkus quarkus-vertx-http, no information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...

br.com.labbs:quarkus-monitor-deployment (>=0.1.5 <=0.3.0), br.com.labbs:quarkus-monitor-reactive-deployment (=1.0.4) +213 more potentially affected by CVE-2022-4116 via io.quarkus:quarkus-vertx-http-deployment (>=0.23.0 <=2.13.4.Final)

io.quarkus:quarkus-vertx-http-deployment MAVEN version =0.23.0, =0.1.5, =1.5.0-Alpha2, =1.0.0, =1.1.0, =0.0.10, =1.0.0, =1.0.0-RC3, =0.4.0, =0.4.0, =0.4.0, =0.20.0 and more Source cves: CVE-2022-4116 Source advisory: OSV:GHSA-G56W-CWG4-HXX9https://vulners.com/osv/OSV:GHSA...