CVE-2018-1304

Apache Tomcat vulnerability CVE-2018-1304 arises from incorrect handling of the empty string URL pattern ("") in security constraint processing, allowing unauthorized access to protected resources. Affected versions: Tomcat 9.0.0.M1–9.0.4, 8.5.0–8.5.27, 8.0.0.RC1–8.0.49, and 7.0.0–7.0.84. This is...

CVE-2023-4853

CVE-2023-4853 affects Quarkus, where HTTP security policy sanitization fails for certain character permutations in requests. The root cause is improper sanitization, allowing bypass of the security policy and potentially granting unauthorized access to endpoints and causing denial of service. The...

CVE-2017-7957

CVE-2017-7957 arises from XStream up to version 1.4.9 mishandling attempts to create an instance of the primitive type void during unmarshalling, which can cause a remote application crash when unmarshalling . The vulnerability is documented across multiple sources (e.g., Nessus/IBM/Guardium bull...

CVE-2023-4066

Red Hat AMQ Broker is affected by CVE-2023-4066. The issue involves passwords stored in a secret security-properties-prop-module (defined in ActivemqArtemisSecurity) that are displayed in plaintext in the StatefulSet YAML of AMQ Broker. The flaw originates from how secrets are surfaced for displa...

CVE-2023-4065

CVE-2023-4065 affects Red Hat AMQ Broker Operator; root cause is a plaintext password defined in ActiveMQArtemisAddress CR being logged in the operator log. This enables an authenticated local attacker to access information outside their permissions. The issue is addressed in Red Hat’s RHSA-2023:...

CVE-2016-3674

Summary: CVE-2016-3674 is an XML External Entity (XXE) vulnerability affecting XStream before 1.4.9, exploitable via crafted XML in multiple drivers (Dom4JDriver, DomDriver, JDomDriver, JDom2Driver, SjsxpDriver, StandardStaxDriver, WstxDriver). Root cause: insecure processing of XML external enti...