CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-36301
https://notcve.org/view.php?id=CVE-2023-36301
26 Jun 2023 — Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet. • https://help.talend.com/r/en-US/Talend-Products-CVEs/Talend-Products-CVEs • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33247
https://notcve.org/view.php?id=CVE-2023-33247
26 May 2023 — Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. (A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog server.) • https://help.talend.com/r/en-US/Talend-Products-CVEs/Talend-Products-CVEs • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-31444
https://notcve.org/view.php?id=CVE-2023-31444
28 Apr 2023 — In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice. This allows for remote access to the JVM via the Jolokia JMX-HTTP bridge. • https://talend.com • CWE-306: Missing Authentication for Critical Function •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26264
https://notcve.org/view.php?id=CVE-2023-26264
13 Apr 2023 — All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsing code. • https://talend.com • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26263
https://notcve.org/view.php?id=CVE-2023-26263
13 Apr 2023 — All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServices/license endpoint of the remote harvesting server. • https://talend.com • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-45589
https://notcve.org/view.php?id=CVE-2022-45589
06 Feb 2023 — All versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT of the Talend ESB Runtime are potentially vulnerable to SQL Injection attacks in the provisioning service only. Users of the provisioning service should upgrade to either 8.0.1-R2022-10-RT or 7.3.1-R2022-09-RT or a later release and use it in place of the previous version. • http://talend.com • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45588
https://notcve.org/view.php?id=CVE-2022-45588
03 Feb 2023 — All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend Remote Engine Gen 1 and Talend Cloud Engine for Design are not impacted. This XXE vulnerability could only be exploited by someone with the appropriate rights to edit pipelines on the Talend platform. It could not be triggered remotely or by other user input. • http://talend.com • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30332
https://notcve.org/view.php?id=CVE-2022-30332
10 Jan 2023 — In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error messages for invalid reset attempts depending on whether the email address is associated with any account. This allows remote attackers to enumerate accounts via a series of requests. En Talend Administration Center 7.3.1.20200219 anterior a TAC-15950, la función Forgot Password proporciona diferentes mensajes de error para intentos de restablecimiento no válidos dependiendo de si la direcci... • https://cwe.mitre.org/data/definitions/204.html • CWE-203: Observable Discrepancy •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-4311 – Talend Open Studio for MDM XML xml external entity reference
https://notcve.org/view.php?id=CVE-2021-4311
09 Jan 2023 — A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The patch is identified as 31d442b9fb1d518128fd18f6e4d54e06c3d67793. It is recommended to apply a patch to fix this issue. • https://github.com/Talend/tmdm-server-se/commit/31d442b9fb1d518128fd18f6e4d54e06c3d67793 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4818 – Talend Open Studio for MDM SystemStorageWrapper.java xml external entity reference
https://notcve.org/view.php?id=CVE-2022-4818
28 Dec 2022 — A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file org.talend.mdm.core/src/com/amalto/core/storage/SystemStorageWrapper.java. The manipulation leads to xml external entity reference. Upgrading to version 20221220_1938 is able to address this issue. • https://github.com/Talend/tmdm-server-se/commit/95590db2ad6a582c371273ceab1a73ad6ed47853 • CWE-611: Improper Restriction of XML External Entity Reference •