CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2023-6267 – Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
https://notcve.org/view.php?id=CVE-2023-6267
25 Jan 2024 — A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security. Se encontró un fallo en el payload json. Si se utiliza seguridad basada en anotaciones para proteger un recurso REST, el cuerpo JSON que el recurso puede consumir se procesa (deserializa) antes de que se evalúen y... • https://access.redhat.com/errata/RHSA-2024:0494 • CWE-280: Improper Handling of Insufficient Permissions or Privileges CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 9.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-6394 – Quarkus: graphql operations over websockets bypass
https://notcve.org/view.php?id=CVE-2023-6394
09 Dec 2023 — A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions. Se encontró un defecto en Quarkus. Este problema ocurre cuando se recibe una solicitud a través de websocket sin ningún permiso basado en roles especificado en ... • https://access.redhat.com/errata/RHSA-2023:7612 • CWE-862: Missing Authorization •
CVSS: 8.1EPSS: 4%CPEs: 18EXPL: 1CVE-2023-4853 – Quarkus: http security policy bypass
https://notcve.org/view.php?id=CVE-2023-4853
15 Sep 2023 — A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service. Se encontró una falla en Quarkus donde las políticas de seguridad HTTP no sanitiza correctamente ciertas permutaciones de caracteres al aceptar solicitudes, lo que res... • https://access.redhat.com/errata/RHSA-2023:5170 • CWE-148: Improper Neutralization of Input Leaders CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0481 – quarkus: insecure permissions on temp files
https://notcve.org/view.php?id=CVE-2023-0481
24 Feb 2023 — In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user. This release of Red Hat build of Quarkus 2.13.8 includes security updates, bug fixes, and enhancements. Issues addressed include cross site request forgery, information leakage, insecure permissions, and traversal vulnerabilities. • https://github.com/quarkusio/quarkus/pull/30694 • CWE-378: Creation of Temporary File With Insecure Permissions CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 7.6EPSS: 0%CPEs: 2EXPL: 0CVE-2022-4147 – quarkus-vertx-http: Security misconfiguration of CORS : OWASP A05_2021 level in Quarkus
https://notcve.org/view.php?id=CVE-2022-4147
06 Dec 2022 — Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request. El filtro Quarkus CORS permite que continúen solicitudes GET y POST simples con origen no válido. Las solicitudes GET o POST simples realizadas con XMLHttpRequest son aquellas que no tienen detectores ... • https://access.redhat.com/security/cve/CVE-2022-4147 • CWE CATEGORY •
CVSS: 10.0EPSS: 20%CPEs: 3EXPL: 0CVE-2022-4116 – quarkus_dev_ui: Dev UI Config Editor is vulnerable to drive-by localhost attacks leading to RCE
https://notcve.org/view.php?id=CVE-2022-4116
22 Nov 2022 — A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution. Se encontró una vulnerabilidad en los quarkus. Esta falla de seguridad ocurre en Dev UI Config Editor, que es vulnerable a ataques de host local que conducen a la ejecución remota de código. A vulnerability was found in quarkus. • https://access.redhat.com/security/cve/CVE-2022-4116 • CWE-94: Improper Control of Generation of Code ('Code Injection') •