Cross-site Scripting (XSS)

Spring Authorization Server is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to user-controlled values being rendered without HTML entity encoding in the default consent page, which allows an attacker to inject malicious content through a crafted OAuth2 authorization request an...

Authentication Bypass

Apache CXF is vulnerable to Authentication Bypass. The vulnerability is due to insufficient validation of required claims in self-issued OIDC ID tokens, including issuer, subject, audience, time, and subjwk binding, which allows an attacker to craft malicious tokens and bypass authentication when...

Improper Certificate Validation

Apache HttpComponents Client is vulnerable to Improper Certificate Validation. The vulnerability is due to the HostnameVerificationPolicyBUILTIN setting being ineffective in the asynchronous HttpClient, which allows an attacker capable of intercepting and modifying traffic to impersonate the...

LDAP Injection

centraldogma-server-auth-shiro is vulnerable to LDAP Injection. The vulnerability is due to insufficient sanitization of the login username before inserting it into an LDAP search filter, which allows an unauthenticated attacker to inject LDAP filter metacharacters, manipulate authentication...

Use Of Hard-coded Credentials

centraldogma-server is vulnerable to Use of Hard-coded Credentials.The vulnerability is due to the server falling back to a publicly known hard-coded secret when replication.secret is not configured, which allows an attacker with network access to authenticate to the embedded ZooKeeper ensemble,...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to revoked access and refresh tokens remaining valid and being reported as active by the token introspection service, which allows an attacker to continue using revoked tokens to access protected resources...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to a flaw in the removeCodeGrant functionality that allows authorization codes to remain reusable, which allows an attacker who captures a valid authorization code to redeem it multiple times and obtain multiple valid...

Improper Input Validation

Apache CXF is vulnerable to Improper Input Validation. The vulnerability is due to JwtRequestCodeFilter copying security-sensitive claims from a signed request JWT into the authorization parameter map without proper validation, which allows an attacker with a validly signed JWT to replace...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to the OAuth2 Dynamic Client Registration endpoint accepting and storing client-supplied scope values without validating them against an allowed scope list, which allows an attacker to self-assign privileged scopes durin...

Time-of-Check Time-of-Use (TOCTOU)

Apache CXF is vulnerable to Time-of-Check Time-of-Use TOCTOU. The vulnerability is due to a race condition in JCacheCodeDataProvider that allows the same authorization code to be redeemed concurrently, which allows an attacker to obtain multiple distinct and valid access tokens from a single...

Deserialization Of Untrusted Data

Apache CXF is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to native Java deserialization of inbound JMS ObjectMessage objects without type restrictions, which allows an attacker who can place messages on the JMS destination to submit malicious serialized objects that...

Improper Input Validation

Apache CXF is vulnerable to Improper Input Validation. The vulnerability is due to failure to validate the chash parameter when it is omitted by a non-compliant or misconfigured Identity Provider, which allows an attacker to substitute or inject an authorization code and potentially gain...

Safety Guard Bypass

Spring Framework is vulnerable to a safety guard bypass. The vulnerability is due to improper enforcement of security restrictions during compiled SpEL expression evaluation, which allows an attacker to bypass the intended safety protections and execute expressions with capabilities that should...

SQL Injection

Apache Hive is vulnerable to SQL Injection. The vulnerability is due to unsanitized partition names being concatenated into direct SQL queries, allowing an authenticated user to alter partition lookups and read, modify, truncate, or affect unintended partition metadata...

Improper Preservation Of Message Metadata

Spring Integration is vulnerable to improper preservation of message metadata. The vulnerability is due to reply and propagated headers being copied from the most recently consumed upstream message when .fluxTransform processes raw payloads asynchronously or out of order, which allows an attacker...

Directory Traversal

Spring Cloud Config is vulnerable to Directory Traversal. The vulnerability is due to improper restriction of configuration file access in the native environment repository, which allows an attacker to access configuration files outside the configured repository path...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service DoS. The vulnerability is due to the Aalto XML processor not correctly enforcing the maxInMemorySize limit when parsing XML input, which allows an attacker to provide oversized XML data that consumes excessive memory and potentially causes a...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial of Service DoS. The vulnerability is due to inefficient processing of the SpEL power operator ^ with BigDecimal or BigInteger operands and large exponent values, which allows an attacker to supply a crafted expression that consumes excessive CPU and memory...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service. The vulnerability is due to stream corruption when Server-Sent Events SSE are used with functional web framework applications in Spring MVC...

UnboundID LDAP Server Administrative Credential Exposure

Spring Security is vulnerable to an UnboundID LDAP Server Administrative Credential Exposure. The vulnerability is due to the embedded UnboundID LDAP server UnboundIdContainer unconditionally registering an administrative credential and binding its listener to all available network interfaces,...

Stream Corruption

Spring Framework is vulnerable to stream corruption. The vulnerability is due to improper handling of response streams when processing SSE with view fragments, which allows an attacker to potentially corrupt or disrupt the application’s HTTP response stream...

Deserialization Of Untrusted Data

Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to SerializingHttpMessageConverter deserializing HTTP request bodies using ObjectInputStream.readObject without class filtering, which allows an unauthenticated attacker to provide a crafted serialized...

Denial Of Service

Spring for GraphQL is vulnerable to Denial of Service. The vulnerability is due to improper validation of pagination arguments in the Spring Data pagination support, where client‑supplied values are passed to the underlying repository and an attacker can forge a malicious query for a Connection...

Cross-Site Request Forgery (CSRF)

Spring for GraphQL is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the GraphiQL page allowing attacker-controlled URLs to trigger requests to application GraphQL endpoints, potentially causing confidential information to be leaked to the attacker's website...

Improper Authorization

Spring Framework is vulnerable to Improper Authorization. The vulnerability is due to a header predicate bypass in pre-flight requests for WebFlux functional endpoints deployed with DispatcherServlet, allowing an attacker to bypass intended header-based restrictions...

Improper Security Configuration

Spring Framework is vulnerable to Improper Security Configuration. The vulnerability is due to response cookies being serialized without the SameSite attribute in WebFlux applications using the Jetty 12 Core reactive adapter...

Memory Leak

Spring Framework is vulnerable to a memory leak. The vulnerability is due to a malformed SETUP frame, where the RSocket server allocates resources without proper cleanup and an attacker can repeatedly send crafted frames to exhaust memory...

Resource Exhaustion

Spring WebFlux is vulnerable to Resource Exhaustion. The vulnerability is due to the PartEventHttpMessageReader not enforcing the maxPartSize limit when maxInMemorySize is set to -1, where an attacker can send arbitrarily large multipart requests that consume excessive memory and trigger a...

Cache Poisoning

Spring AI is vulnerable to cache poisoning. The vulnerability is due to insecure handling of the deterministic cache path, where an attacker can pre‑create the cache directory and plant a malicious ONNX model file and achieve execution when the model is loaded...

Command Injection

NocoBase is vulnerable to Command Injection. The vulnerability is due to unsanitized interpolation of the database.schema value from crafted backup metadata into shell commands executed with childprocess.exec, which allows an authenticated backup-management user to execute arbitrary commands with...

Resource Exhaustion

Spring Batch is vulnerable to resource exhaustion. The vulnerability is due to the way FlatFileItemReader assembles multi-line records, where a specially crafted input file can cause excessive CPU consumption and memory usage, leading the batch job to stall or run out of memory...

Sensitive Information Exposure

io.netty.incubator is vulnerable to sensitive information exposure. The vulnerability is due to private key bytes being included in string representations and exception messages, which allows an attacker with access to application logs to obtain exposed private key material and potentially use it...

Deserialization RCE

Spring Batch is vulnerable to deserialization RCE. The vulnerability is due to the JobParameterDeserializer not properly enforcing the trusted-types allowlist, where applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer from an untrusted job repository can...

Improper Authentication

github.com/seaweedfs/seaweedfs is vulnerable to improper authentication. The vulnerability is due to the filer registering the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, which allows an attacker who can reach the filer gRPC po...

Sandbox Bypass

Apache Syncope is vulnerable to a Sandbox bypass. The vulnerability is due to improper isolation of the Groovy security sandbox, where an administrator with sufficient entitlements can create a malicious Groovy class containing untrusted code, and attackers can bypass the sandbox to execute...

Server-Side Request Forgery (SSRF)

Apache Hive is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper handling of the avro.schema.url table property, which allows an authenticated remote attacker with CREATE TABLE privileges to configure an attacker-controlled URL and cause the Hive server to make...

URL Path Injection

Apache Gravitino is vulnerable to URL Path Injection. The vulnerability is due to unencoded user-supplied identifiers being used in URL paths, allowing an attacker to inject path components into requests...

SQL Injection

WsgiDAV is vulnerable to SQL Injection. The vulnerability is due to the MySQLBrowserProvider directly concatenating a record key from the request URL into SQL WHERE clauses, which allows an attacker with access to a share configured with this non-default provider to inject malicious SQL through a...

Improper Input Validation

Graylog is vulnerable to Improper Input Validation. The vulnerability is due to improper parsing of field-like text and escaped quotes within quoted FortiGate syslog values, which allows an unauthenticated network attacker to manipulate or overwrite security-log fields or cause messages to be...

XML External Entity (XXE) Injection

mapfish-print is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper parsing of attacker-controlled XML with external entities and DTDs enabled, which allows an unauthenticated attacker to read local files and perform server-side request forgery SSRF by accessing...

Authentication Bypass

Red Hat Build of Keycloak keycloak-services is vulnerable to an authentication bypass. The vulnerability is due to improper validation in the reset-credentials flow, which allows an unauthenticated attacker to bypass the required email verification step and directly set new credentials...

Path Traversal

Apache Camel is vulnerable to Path Traversal. The vulnerability is due to the Azure Storage Blob component constructing local file paths directly from attacker-influenced blob names without path normalization or containment checks, which allows an attacker to create or overwrite files outside the...

Improper Input Validation

github.com/free5gc/free5gc is vulnerable to improper input validation. The vulnerability is due to insufficient validation of NF Profile data, which allows an attacker with SBI access to submit malicious profiles containing attacker-controlled network-function endpoints, causing them to be...

OCSP Response Validation Bypass

Bouncy Castle for Java is vulnerable to an OCSP response validation bypass. The vulnerability is due to the failure to properly associate the stapled OCSP response with the intended certificate, which allows an attacker to exploit the validation process by providing a valid OCSP response for a...

SQL Injection

ureport is vulnerable to SQL Injection. The vulnerability is due to insufficient validation of SQL statements in the /ureport/datasource/previewData component, which allows an attacker to inject crafted SQL queries and access sensitive database information...

URI Validation Bypass

http4k-security-digest is vulnerable to URI Validation Bypass. The vulnerability is due to the client not validating the uri parameter in the Digest authentication response against the actual request URL, which allows an attacker to replay a captured authentication response against other URLs...

Privilege Escalation

Keycloak is vulnerable to Improper Authorization. The vulnerability is due to the Dynamic Client Registration policy failing to re-validate protocol mapper types during client updates, allowing an attacker with client registration privileges to replace an allowed mapper with a restricted...

Authorization Bypass

Keycloak is vulnerable to Authorization Bypass. The vulnerability is due to the token exchange feature ignoring tenant restrictions, where the restriction check is bypassed and an attacker with a valid Microsoft token from a different organization can gain access to the Keycloak realm...

Improper Authentication

Keycloak is vulnerable to Improper Authentication. The vulnerability is due to incorrect handling of SAML identity provider metadata that lacks key usage attributes, which allows an unauthenticated attacker to bypass SAML signature validation, forge a SAML response, and gain unauthorized access t...

Improper Certificate Validation

RabbitMQ Java client library is vulnerable to improper certificate validation. The vulnerability is due to ConnectionFactory.useSslProtocol accepting arbitrary server certificates and disabling hostname verification, which allows a network attacker to intercept TLS connections, impersonate the...