CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-20306
https://notcve.org/view.php?id=CVE-2021-20306
01 Jun 2021 — A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality. Se encontró un fallo en el editor BPMN en versión jBPM 7.51.0.Final. Cualquier usuario autenticado de cualquier proyecto puede visualizar el nombre de los Ruleflow Groups de otros proyectos, a pesar de que el usuario no tenga acc... • https://bugzilla.redhat.com/show_bug.cgi?id=1946213 • CWE-863: Incorrect Authorization •
CVSS: 7.4EPSS: 0%CPEs: 12EXPL: 0CVE-2021-20218 – fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise
https://notcve.org/view.php?id=CVE-2021-20218
16 Mar 2021 — A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2 Se encontró un fallo en fabric8 kubernetes-client en versión 4.2.0 y p... • https://bugzilla.redhat.com/show_bug.cgi?id=1923405 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-10714 – wildfly-elytron: session fixation when using FORM authentication
https://notcve.org/view.php?id=CVE-2020-10714
17 Aug 2020 — A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en versión 1.11.3.Final y anteriores de WildFly Elytron. Cuando se usa la autenticación FORM de WildFly Elytron con un ID de sesión en la URL, un atacante podría llevar a ... • https://bugzilla.redhat.com/show_bug.cgi?id=1825714 • CWE-384: Session Fixation •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-1748 – Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain
https://notcve.org/view.php?id=CVE-2020-1748
17 Aug 2020 — A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources. Se encontró un fallo en todas las versiones compatibles anteriores a wildfly-elytron-1.6.8.Final-redhat-00001, donde las comprobaciones de la función WildFlySecurityManager son omitidas cuando se usan a... • https://bugzilla.redhat.com/show_bug.cgi?id=1807707 • CWE-285: Improper Authorization •
CVSS: 8.8EPSS: 2%CPEs: 7EXPL: 0CVE-2020-1714 – keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-1714
13 May 2020 — A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution. Se detectó un fallo en Keycloak versiones anteriores a 11.0.0, donde la base de código contiene usos de la función ObjectInputStream sin ningún tipo de comprobaciones. Este fallo permite a un atacante ... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2019-14892 – jackson-databind: Serialization gadgets in classes of the commons-configuration package
https://notcve.org/view.php?id=CVE-2019-14892
20 Jan 2020 — A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code. Se detectó un fallo en jackson-databind en las versiones anteriores a 2.9.10, 2.8.11.5 y 2.6.7.3, donde permitiría una deserialización polimórfica de un objeto malicioso utilizando las clases JNDI de commons-configuration 1 y 2. Un atacante... • https://access.redhat.com/errata/RHSA-2020:0729 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-502: Deserialization of Untrusted Data •
CVSS: 6.1EPSS: 1%CPEs: 7EXPL: 2CVE-2019-14862 – knockout: Cross-site Scripting (XSS) attacks due to not escaping the name attribute.
https://notcve.org/view.php?id=CVE-2019-14862
03 Dec 2019 — There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it. Hay una vulnerabilidad en knockout versiones anteriores a la versión 3.5.0-beta, donde después de escapar del contexto de la aplicación web, la aplicación web entrega datos a sus usuarios junto con otro contenido dinámico seguro, sin comprobarlo. Red Hat Decision Manager is an o... • https://github.com/ossf-cve-benchmark/CVE-2019-14862 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-14863 – angular: Cross-site Scripting (XSS) due to no proper sanitization of xlink:href attributes
https://notcve.org/view.php?id=CVE-2019-14863
03 Dec 2019 — There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it. Hay una vulnerabilidad en todas las versiones de angular anteriores a la versión 1.5.0-beta.0, donde después de escapar del contexto de la aplicación web, la aplicación web entrega datos a sus usuarios junto con otro contenido dinámico seguro, sin comprobarlo. A cross-site... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14863 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 1%CPEs: 429EXPL: 0CVE-2019-10219 – hibernate-validator: safeHTML validator allows XSS
https://notcve.org/view.php?id=CVE-2019-10219
08 Nov 2019 — A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack. Una vulnerabilidad fue encontrada en Hibernate-Validator. La anotación del validador SafeHtml no puede sanear apropiadamente las cargas útiles que consisten en código potencialmente malicioso en los comentarios e instrucciones HTML. • https://access.redhat.com/errata/RHSA-2020:0159 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 218EXPL: 7CVE-2019-11358 – jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
https://notcve.org/view.php?id=CVE-2019-11358
19 Apr 2019 — jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. jQuery, en versiones anteriores a 3.4.0, como es usado en Drupal, Backdrop CMS, y otros productos, maneja mal jQuery.extend(true, {}, ...) debido a la contaminación de Object.prototype. Si un objeto fuente no sanitizado contenía una propi... • https://github.com/isacaya/CVE-2019-11358 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •