CVE-2020-11975

Apache Unomi is vulnerable to Remote Code Execution (RCE) due to improper input validation in its OGNL scripting engine. Attackers can leverage conditions to call static Java classes from the JDK, allowing for the execution of arbitrary code with the permissions of the running Java process. This ...

CVE-2021-31164

CVE-2021-31164 concerns Apache Unomi prior to version 1.5.5, where CRLF log injection is possible due to lack of escaping in log statements. Multiple sources (NVD, RH, OSV, CNVD/CNNVD, CVE lists) confirm the issue and correlate it with a pre-1.5.5 release. The vulnerability arises from improper h...