CVE-2022-36437

CVE-2022-36437 pertains to Hazelcast and Hazelcast Jet where the Connection handler can be exploited by a remote unauthenticated attacker to access and manipulate data in the cluster using another authenticated connection’s identity. Affected Hazelcast versions: up to 4.0.6, 4.1.9, 4.2.5, 5.0.3, ...

CVE-2022-0265

CVE-2022-0265 affects Hazelcast (Hazelcast IMDG) in version 5.1-BETA-1, exposing an XML External Entity (XXE) processing weakness. The description and related advisories indicate improper restriction of XML external entities in the Hazelcast code path, enabling an attacker to reference external e...

CVE-2023-33264

CVE-2023-33264 affects Hazelcast through 5.0.4, 5.1–5.1.6, and 5.2–5.2.3, where configuration routines do not mask passwords in the member configuration, allowing Hazelcast Management Center users to view some secrets. Multiple connected sources confirm impact on Hazelcast and variants of product...

CVE-2023-33265

Hazelcast vulnerability CVE-2023-33265 affects Hazelcast Platform/IMDG versions 5.0.4 or earlier, 5.1 up to 5.1.6, and 5.2 up to 5.2.3. The root cause is that executor services do not properly enforce client permissions, allowing authenticated users to execute tasks on cluster members without the...

CVE-2016-10750

CVE-2016-10750 is a Java deserialization RCE vulnerability in Hazelcast used by Atlassian Confluence Data Center when running in a clustered configuration. A remote, unauthenticated attacker can exploit the issue by sending a crafted JoinRequest to a Hazelcast instance listening on the cluster po...

CVE-2023-45859

CVE-2023-45859 affects Hazelcast client/server components up to versions listed in the description (Hazelcast through 4.1.10, 4.2.x, 5.0.x, 5.1.x, 5.2.x, and 5.3.x up to 5.3.2). The vulnerability arises from insufficient permission checks in certain client operations, allowing authenticated users...

CVE-2023-45860

Hazelcast Platform up to 5.3.4 is affected by a permission-checking flaw in the SQL mapping for the CSV File Source connector, potentially enabling unauthorized clients to read files on a member’s filesystem. Root cause: inadequate access checks. Impact: data exposure of local files. Remediation:...

CVE-2020-26168

The CVE-2020-26168 entry describes a vulnerability in Hazelcast IMDG Enterprise 4.x before 4.0.3 and Jet Enterprise 4.x through 4.2 where the LDAP authentication method in LdapLoginModule does not verify passwords properly in certain system-user-dn scenarios. Consequence: clients/members can be a...