Threat and Vulnerability Intelligence Database

RSS Feed

Example Searches:

CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
[org.verapdf:core-arlington] veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability
Description: Impact Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. Patches We are currently working on a patch that will be released when ready. Workarounds This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. References Original issue: #1488 References https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x https://nvd.nist.gov/vuln/detail/CVE-2024-52800 https://github.com/veraPDF/veraPDF-library/issues/1488 https://github.com/advisories/GHSA-4cx5-89vm-833x
Source: Github Advisory Database (Maven)
December 3rd, 2024 (5 months ago)
[org.verapdf:verapdf.library] veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability
Description: Impact Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. Patches We are currently working on a patch that will be released when ready. Workarounds This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. References Original issue: #1488 References https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x https://nvd.nist.gov/vuln/detail/CVE-2024-52800 https://github.com/veraPDF/veraPDF-library/issues/1488 https://github.com/advisories/GHSA-4cx5-89vm-833x
Source: Github Advisory Database (Maven)
December 3rd, 2024 (5 months ago)
[org.verapdf:verapdf-library-jakarta] veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability
Description: Impact Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. Patches We are currently working on a patch that will be released when ready. Workarounds This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. References Original issue: #1488 References https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x https://nvd.nist.gov/vuln/detail/CVE-2024-52800 https://github.com/veraPDF/veraPDF-library/issues/1488 https://github.com/advisories/GHSA-4cx5-89vm-833x
Source: Github Advisory Database (Maven)
December 3rd, 2024 (5 months ago)
[org.verapdf:verapdf-library-arlington] veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability
Description: Impact Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. Patches We are currently working on a patch that will be released when ready. Workarounds This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. References Original issue: #1488 References https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x https://nvd.nist.gov/vuln/detail/CVE-2024-52800 https://github.com/veraPDF/veraPDF-library/issues/1488 https://github.com/advisories/GHSA-4cx5-89vm-833x
Source: Github Advisory Database (Maven)
December 3rd, 2024 (5 months ago)
[io.lettuce:lettuce-core] Netty vulnerability included in redis lettuce
Description: Summary Note: i'm reporting this in this way purely because it's private and i don't want to broadcast vulnerabilities. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115. Details https://github.com/redis/lettuce/blob/main/pom.xml#L67C9-L67C53 The netty version pinned here is currently 4.1.113.Final This version is vulnerable according to Snyk and is affecting one of our products: Here is a link to the CVE PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Not applicable Impact What kind of vulnerability is it? Who is impacted? Denial of Service, affecting Windows users. References https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv https://github.com/redis/lettuce/security/advisories/GHSA-q4h9-7rxj-7gx2 https://nvd.nist.gov/vuln/detail/CVE-2024-47535 https://github.com/advisories/GHSA-q4h9-7rxj-7gx2
Source: Github Advisory Database (Maven)
December 3rd, 2024 (5 months ago)
[org.springframework:spring-beans] Spring Framework has Authorization Bypass for Case Sensitive Comparisons
Description: The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly. References https://nvd.nist.gov/vuln/detail/CVE-2024-38827 https://spring.io/security/cve-2024-38827 https://github.com/spring-projects/spring-framework/issues/33708 https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9 https://github.com/advisories/GHSA-q3v6-hm2v-pw99
Source: Github Advisory Database (Maven)
December 3rd, 2024 (5 months ago)
[org.springframework:spring-context] Spring Framework has Authorization Bypass for Case Sensitive Comparisons
Description: The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly. References https://nvd.nist.gov/vuln/detail/CVE-2024-38827 https://spring.io/security/cve-2024-38827 https://github.com/spring-projects/spring-framework/issues/33708 https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9 https://github.com/advisories/GHSA-q3v6-hm2v-pw99
Source: Github Advisory Database (Maven)
December 3rd, 2024 (5 months ago)
[org.springframework:spring-core] Spring Framework has Authorization Bypass for Case Sensitive Comparisons
Description: The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly. References https://nvd.nist.gov/vuln/detail/CVE-2024-38827 https://spring.io/security/cve-2024-38827 https://github.com/spring-projects/spring-framework/issues/33708 https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9 https://github.com/advisories/GHSA-q3v6-hm2v-pw99
Source: Github Advisory Database (Maven)
December 3rd, 2024 (5 months ago)
[org.springframework:spring-expression] Spring Framework has Authorization Bypass for Case Sensitive Comparisons
Description: The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly. References https://nvd.nist.gov/vuln/detail/CVE-2024-38827 https://spring.io/security/cve-2024-38827 https://github.com/spring-projects/spring-framework/issues/33708 https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9 https://github.com/advisories/GHSA-q3v6-hm2v-pw99
Source: Github Advisory Database (Maven)
December 3rd, 2024 (5 months ago)
[org.springframework:spring-jdbc] Spring Framework has Authorization Bypass for Case Sensitive Comparisons
Description: The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly. References https://nvd.nist.gov/vuln/detail/CVE-2024-38827 https://spring.io/security/cve-2024-38827 https://github.com/spring-projects/spring-framework/issues/33708 https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9 https://github.com/advisories/GHSA-q3v6-hm2v-pw99
Source: Github Advisory Database (Maven)
December 3rd, 2024 (5 months ago)