CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2016-6521
https://notcve.org/view.php?id=CVE-2016-6521
23 Jan 2017 — Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors. Vulnerabilidad de CSRF en la consola de Grails (también conocida como Grails Debug Console y Grails Web Console) 2.0.7, 1.5.10 y versiones anteriores permite a atacantes remotos secuestrar la autenticación de usuarios para solicitudes... • http://www.openwall.com/lists/oss-security/2016/08/02/11 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 38EXPL: 0CVE-2014-2857
https://notcve.org/view.php?id=CVE-2014-2857
15 Apr 2014 — The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5. La configuración por defecto del plugin Resources 1.0.0 anterior a 1.2.6 para Pivotal Grails 2.0.0 hasta 2.3.6 no restringe debidamente acceso a archivos en el direc... • http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.3EPSS: 0%CPEs: 38EXPL: 0CVE-2014-2858
https://notcve.org/view.php?id=CVE-2014-2858
15 Apr 2014 — Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a "configured block." NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types. Vulnerabilidad de salto de directorio en el plugin Resources 1.0.0 anterior a 1.2.6 para Pivotal Grails 2.0.0 hasta 2.3.6 permite a atacantes remotos obtener información sensible a través de... • http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 37EXPL: 0CVE-2014-0053 – Grails 2.3.5 Information Disclosure
https://notcve.org/view.php?id=CVE-2014-0053
20 Feb 2014 — The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal. La configuración por defecto del plugin Resources 1.0.0 anter... • http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html • CWE-264: Permissions, Privileges, and Access Controls •