CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0981 – quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus
https://notcve.org/view.php?id=CVE-2022-0981
23 Mar 2022 — A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended. Se ha encontrado un fallo en Quarkus. El estado y los permisos potencialmente asociados pueden filtrarse de una petición web a otra en RestEasy Reactive. • https://bugzilla.redhat.com/show_bug.cgi?id=2062520 • CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 4%CPEs: 8EXPL: 2CVE-2022-21724 – Unchecked Class Instantiation when providing Plugin Classes
https://notcve.org/view.php?id=CVE-2022-21724
02 Feb 2022 — pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implemen... • https://github.com/ToontjeM/CVE-2022-21724 • CWE-665: Improper Initialization •
CVSS: 6.6EPSS: 0%CPEs: 2EXPL: 0CVE-2022-21363 – mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors
https://notcve.org/view.php?id=CVE-2022-21363
19 Jan 2022 — Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). • https://www.oracle.com/security-alerts/cpujan2022.html • CWE-280: Improper Handling of Insufficient Permissions or Privileges •
CVSS: 6.5EPSS: 0%CPEs: 22EXPL: 0CVE-2021-43797 – HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
https://notcve.org/view.php?id=CVE-2021-43797
09 Dec 2021 — Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used ... • https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 7.9EPSS: 57%CPEs: 7EXPL: 3CVE-2021-2471 – mysql-connector-java: unauthorized access to critical
https://notcve.org/view.php?id=CVE-2021-2471
20 Oct 2021 — Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash ... • https://github.com/cckuailong/CVE-2021-2471 • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 2CVE-2021-28170 – jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate
https://notcve.org/view.php?id=CVE-2021-28170
26 May 2021 — In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid. En la implementación de Jakarta Expression Language versiones 3.0.3 y anteriores, un bug en la función ELParserTokenManager permite que las expresiones EL no válidas sean evaluadas como si fueran válidas Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This rele... • https://github.com/eclipse-ee4j/el-ri/issues/155 • CWE-20: Improper Input Validation CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •