CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-36301
https://notcve.org/view.php?id=CVE-2023-36301
Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet. • https://help.talend.com/r/en-US/Talend-Products-CVEs/Talend-Products-CVEs • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33247
https://notcve.org/view.php?id=CVE-2023-33247
Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. (A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog server.) • https://help.talend.com/r/en-US/Talend-Products-CVEs/Talend-Products-CVEs •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-31444
https://notcve.org/view.php?id=CVE-2023-31444
In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice. This allows for remote access to the JVM via the Jolokia JMX-HTTP bridge. • https://talend.com https://www.talend.com/security/incident-response/#CVE-2023-31444 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26263
https://notcve.org/view.php?id=CVE-2023-26263
All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServices/license endpoint of the remote harvesting server. • https://talend.com https://www.talend.com/security/incident-response/#CVE-2023-26264 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26264
https://notcve.org/view.php?id=CVE-2023-26264
All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsing code. • https://talend.com https://www.talend.com/security/incident-response/#CVE-2023-26264 • CWE-611: Improper Restriction of XML External Entity Reference •