CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-46131 – Grails® data binding causes JVM crash and/or DoS
https://notcve.org/view.php?id=CVE-2023-46131
20 Dec 2023 — Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0. Grails es un framework utilizado para crear aplicaciones web con el lenguaje de programación Groovy. • https://github.com/grails/grails-core/commit/74326bdd2cf7dcb594092165e9464520f8366c60 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2022-41923 – Grails Spring Security Core plugin vulnerable to privilege escalation
https://notcve.org/view.php?id=CVE-2022-41923
23 Nov 2022 — Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoint) using the authorization requirements of a different endpoint (i.e. the donor endpoint). In some Grails framework applications, access to the targeted endpoint will be granted based on meeting the authorization requirements of the donor endpoint, which can result in a privilege escalation attack. This vulnerability has been patched in grails-spring... • https://github.com/grails/GSSC-CVE-2022-41923 • CWE-269: Improper Privilege Management CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 3%CPEs: 4EXPL: 0CVE-2022-35912
https://notcve.org/view.php?id=CVE-2022-35912
19 Jul 2022 — In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader. En grails-databinding en Grails versiones anteriores a 3.3.15, 4.x anteriores a 4.1.1, 5.x anteriores a 5.1.9, y 5.2.x anteriores a 5.2.1 (al menos cuando son usadas determinadas configuraciones de Java 8), la vinculación de datos permite a un atacante remo... • http://www.openwall.com/lists/oss-security/2022/07/20/4 •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-12728
https://notcve.org/view.php?id=CVE-2019-12728
04 Jun 2019 — Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP. Grails anterior de la versión 3.3.10 usaba cleartext HTTP para resolver el servicio de notificación SDKMan. NOTA: las aplicaciones de los usuarios no resolvían las posesiones a través de HTTP de texto simple. • https://github.com/grails/grails-core/issues/11250 • CWE-494: Download of Code Without Integrity Check •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2018-1000529
https://notcve.org/view.php?id=CVE-2018-1000529
26 Jun 2018 — Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8. El plugin Grails Fields 2.2.7 contiene una vulnerabilidad de Cross Site Scripting (XSS) por el uso de la etiqueta display que puede resultar en XSS. La vulnerabilidad parece haber sido solucionada en la versión 2.2.8. • https://github.com/martinfrancois/CVE-2018-1000529 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2014-3626
https://notcve.org/view.php?id=CVE-2014-3626
19 Mar 2018 — The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did not step outside the appropriate root directory (e.g. the web application root), decoded the URI and checked that this did not introduce additional /../ (and similar) sequences. A bug was introduced where the Grails R... • https://pivotal.io/security/cve-2014-3626 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2017-6344
https://notcve.org/view.php?id=CVE-2017-6344
27 Feb 2017 — XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document. Vulnerabilidad XEE en Grails PDF Plugin 0.6 permite a atacantes remotos leer archivos arbitrarios a través de un documento XML manipulado. • http://www.securityfocus.com/bid/96446 • CWE-611: Improper Restriction of XML External Entity Reference •