CVE-2018-1273

CVE-2018-1273 is a remote code execution vulnerability in Spring Data Commons (affecting versions prior to 1.13.10 and 2.0–2.0.5, plus older unsupported builds). An unauthenticated attacker could supply crafted request parameters against Spring Data REST HTTP resources or via Spring Data projecti...

CVE-2018-8018

Impacted component: Apache Ignite. Affected versions include before 2.4.8 and 2.5.x before 2.5.3, where the serialization mechanism does not maintain a whitelist of allowed classes. Root cause: grids deserializing untrusted data via GridClientJdkMarshaller without a restricted class list, enablin...

CVE-2018-1295

CVE-2018-1295 affects Apache Ignite 2.3 and earlier. The root cause is the serialization mechanism lacking a whitelist of allowed classes, enabling arbitrary code execution when a crafted serialized object is deserialized at endpoints such as discovery SPI, Ignite persistence, Memcached endpoint,...