CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-46131 – Grails® data binding causes JVM crash and/or DoS
https://notcve.org/view.php?id=CVE-2023-46131
20 Dec 2023 — Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0. Grails es un framework utilizado para crear aplicaciones web con el lenguaje de programación Groovy. • https://github.com/grails/grails-core/commit/74326bdd2cf7dcb594092165e9464520f8366c60 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 10.0EPSS: 3%CPEs: 4EXPL: 0CVE-2022-35912
https://notcve.org/view.php?id=CVE-2022-35912
19 Jul 2022 — In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader. En grails-databinding en Grails versiones anteriores a 3.3.15, 4.x anteriores a 4.1.1, 5.x anteriores a 5.1.9, y 5.2.x anteriores a 5.2.1 (al menos cuando son usadas determinadas configuraciones de Java 8), la vinculación de datos permite a un atacante remo... • http://www.openwall.com/lists/oss-security/2022/07/20/4 •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-12728
https://notcve.org/view.php?id=CVE-2019-12728
04 Jun 2019 — Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP. Grails anterior de la versión 3.3.10 usaba cleartext HTTP para resolver el servicio de notificación SDKMan. NOTA: las aplicaciones de los usuarios no resolvían las posesiones a través de HTTP de texto simple. • https://github.com/grails/grails-core/issues/11250 • CWE-494: Download of Code Without Integrity Check •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2018-1000529
https://notcve.org/view.php?id=CVE-2018-1000529
26 Jun 2018 — Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8. El plugin Grails Fields 2.2.7 contiene una vulnerabilidad de Cross Site Scripting (XSS) por el uso de la etiqueta display que puede resultar en XSS. La vulnerabilidad parece haber sido solucionada en la versión 2.2.8. • https://github.com/martinfrancois/CVE-2018-1000529 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •