CVE-2020-11975

Apache Unomi is vulnerable to Remote Code Execution (RCE) due to improper input validation in its OGNL scripting engine. Attackers can leverage conditions to call static Java classes from the JDK, allowing for the execution of arbitrary code with the permissions of the running Java process. This ...

CVE-2020-13942

CVE-2020-13942 affects Apache Unomi before 1.5.2, where OGNL/MVEL-based input could lead to remote code execution via the /context.json endpoint. The root cause is unsafely evaluating scripting expressions in conditions, allowing an attacker to invoke Java classes and functions; multiple public P...

CVE-2021-31164

CVE-2021-31164 concerns Apache Unomi prior to version 1.5.5, where CRLF log injection is possible due to lack of escaping in log statements. Multiple sources (NVD, RH, OSV, CNVD/CNNVD, CVE lists) confirm the issue and correlate it with a pre-1.5.5 release. The vulnerability arises from improper h...