Apache Neethi versions prior to 3.2.2 are vulnerable to a denial of service (DoS) attack caused by algorithmic complexity during policy normalization. Maliciously crafted WS-Policy documents can trigger an exponential expansion of policy alternatives, leading to unbounded memory allocation and JVM heap exhaustion. This vulnerability is addressed in version 3.2.2, which limits the maximum number of normalized policy alternatives.
Apache Neethi versions prior to 3.2.2 do not properly detect circular references in WS-Policy documents. This flaw can cause the policy normalization process to enter an infinite loop or excessive recursion, resulting in a stack overflow or application hang. An attacker can exploit this by crafting malicious policy documents with circular references, leading to a denial of service (DoS) condition. The issue is fixed in version 3.2.2.
Shopizer versions up to 2.16.0 contain multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class. These flaws allow attackers with valid credentials to inject malicious scripts or HTML via crafted payloads in the getInputStream() or getReader() functions. The vulnerabilities have a medium severity with a CVSS score of 5.4.
Shopizer versions up to 2.16.0 contain a critical path traversal vulnerability in the /content/images/add endpoint. This flaw allows unauthenticated attackers to write arbitrary files to any writable location on the server by sending a crafted POST request. The vulnerability has a CVSS 3.1 base score of 10.0, indicating maximum severity with complete confidentiality, integrity, and availability impact.
The Jenkins Microsoft Entra ID (previously Azure AD) Plugin versions 666.v6060de32f87d and earlier contain an open redirect vulnerability. This flaw allows an attacker to craft a Jenkins login URL that redirects users to an external site after authentication, facilitating phishing attacks. The issue is fixed in version 667.v4c5827a, which restricts redirects to relative Jenkins URLs only.
The Jenkins HTML Publisher Plugin versions 427 and earlier contain a stored cross-site scripting (XSS) vulnerability due to improper escaping of the job name and URL in the legacy wrapper file. This vulnerability can be exploited by attackers who have Item/Configure permission. The issue is fixed in version 427.1, which properly escapes these fields to prevent XSS attacks.
Jenkins GitHub Branch Source Plugin versions up to 1967.1969.v205fd594c821 have a missing permission check in a form validation method. This flaw allows users with Overall/Read permission to perform a connection test using attacker-specified URLs and GitHub App credentials. The issue is fixed in version 1967.1969.v205fd594c821, which requires Overall/Manage permission for the connection test.
The Jenkins Matrix Authorization Strategy Plugin versions 2.0-beta-1 through 3.2.9 allow unsafe deserialization by invoking parameterless constructors of classes specified in configuration without restricting which classes can be instantiated. This vulnerability can be exploited by attackers with Item/Configure permission to instantiate arbitrary types, potentially leading to information disclosure or other impacts depending on available classes. The issue is fixed in version 3.2.10, which verifies that only inheritance strategy implementations can be instantiated.
The Jenkins Credentials Binding Plugin versions 719.v80e905ef14eb_ and earlier contain a path traversal vulnerability that allows attackers with the ability to provide credentials to a job to write files to arbitrary locations on the node filesystem. This can lead to remote code execution if Jenkins is configured to allow low-privileged users to configure file or zip file credentials for jobs running on the built-in node. The vulnerability is fixed in version 720.v3f6decef43ea_, which sanitizes file names to prevent path traversal.
A vulnerability in Jenkins Script Security Plugin versions prior to 1402.v94c9ce464861 allows users with Overall/Read permission to enumerate pending and approved Script Security classpaths due to missing permission checks on an HTTP endpoint. This issue is fixed in version 1402.v94c9ce464861, which requires Overall/Administer permission for such enumeration.
A stored cross-site scripting (XSS) vulnerability exists in Jenkins GitHub Plugin versions 1.46.0 and earlier. The vulnerability arises from improper processing of the current job URL in JavaScript validation for the "GitHub hook trigger for GITScm polling" feature. This flaw allows non-anonymous users with Overall/Read permission to exploit the vulnerability. The issue is resolved starting from version 1.46.0.1, which no longer processes the current job URL in the vulnerable JavaScript code.
Spring MVC and WebFlux applications running on Windows that serve static resources from the file system are vulnerable to Denial of Service (DoS) attacks. An attacker can send specially crafted slow-to-resolve requests that keep HTTP connections occupied, potentially causing service unavailability. This vulnerability affects specific versions of the Spring WebFlux framework and has a medium severity rating.
A resource injection vulnerability exists in Xuxueli xxl-job versions prior to 3.4.0 in the logDetailCat function of the Execution Log Handler component. This flaw allows improper control of resource identifiers via manipulation of the logId argument. The vulnerability is remotely exploitable but considered difficult to exploit and has low severity. A public exploit is available. Upgrading to version 3.4.0 addresses the issue.
A vulnerability in Spring gRPC versions 1.0.0 through 1.0.2 causes server-side AuthenticationException messages to be reflected back to unauthenticated remote clients in the gRPC status description. This information disclosure may aid attackers in understanding authentication failures. The issue is fixed in version 1.0.3.
A vulnerability in Spring gRPC versions 1.0.0 through 1.0.2 allows the SecurityContext of an authenticated user to leak across requests when authorization fails. This occurs because the authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread, potentially granting escalated permissions. The issue is fixed in version 1.0.3.
A SQL injection vulnerability exists in Spring AI's CosmosDBVectorStore component, specifically in the doDelete() method. This flaw allows attackers with limited privileges to execute arbitrary SQL queries by crafting malicious document IDs. The issue affects Spring AI versions 1.0.0 through 1.0.5 and 1.1.0 through 1.1.4. Fixed versions are 1.0.6 and 1.1.5.
Spring AI versions 1.0.0 through 1.0.5 and 1.1.0 through 1.1.4 have a vulnerability where the ONNX model cache is world-writable and predictable. This can expose the ONNX model in shared environments, potentially allowing unauthorized modification. The issue is fixed in versions 1.0.6 and 1.1.5.
A vulnerability in Spring AI's PDF document reader component allows an attacker to craft a malicious PDF that triggers excessive memory allocation during processing by the ForkPDFLayoutTextStripper class. This can lead to an out-of-memory (OOM) condition causing denial of service. The issue affects Spring AI versions 1.0.0 through 1.0.5 and 1.1.0 through 1.1.4. Fixed versions 1.0.6 and 1.1.5 address this problem.
Spring AI's VectorStore FilterExpressionConverter implementations improperly escape keys and values in filter expressions, allowing alteration of vector store queries. This vulnerability affects Spring AI versions 1.0.0 through 1.0.5 and 1.1.0 through 1.1.4, with fixes available in versions 1.0.6 and 1.1.5. The flaw can lead to high impact including confidentiality loss, limited integrity compromise, and availability disruption.
A vulnerability in Spring Boot's ApplicationPidFileWriter allows a local attacker with write access to the PID file location to corrupt a file on the host each time the application starts. This affects multiple Spring Boot versions prior to fixed releases. The issue involves following symlinks at predictable default locations, enabling file corruption.