CVE-2020-11980

CVE-2020-11980 affects Apache Karaf JMX where JAAS-based authentication and ACL-based authorization allow a non-admin with a viewer role to call get* via etc/jmx.acl.cfg, potentially triggering getMBeansFromURL to fetch MBeans remotely and register them, enabling SSRF-like behavior and MBean regi...

CVE-2019-0191

Summary: CVE-2019-0191 affects Apache Karaf kar deployer. The ZIP-slip vulnerability arises because the kar deployer reads .kar archives and extracts entries from repository/ and resources/ without validating paths, allowing a malicious .kar to contain directory traversal (..), which can cause th...

CVE-2016-8750

CVE-2016-8750 affects Apache Karaf prior to 4.0.8. The LDAPLoginModule did not properly encode usernames when authenticating via LDAP, exposing a vulnerability to LDAP injection that can lead to Denial of Service. Vulnerable component: Karaf’s LDAP authentication path; root cause: improper userna...