Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.

Affected: Maven: io.hawt:hawtio-core

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.

netty: Infinite loop vulnerability when handling renegotiation using SslProvider.OpenSsl elasticsearch: Information exposure via _cluster/settings API pdfbox: unbounded computation in parser resulting in a denial of service vertx: WebSocket HTTP upgrade implementation holds the entire http request in memory before the handshake dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure. spring-data-jpa: Additional information exposure with Spring Data JPA derived queries HTTP/2: large amount of data requests leads to denial of service hawtio: server side request forgery via initial /proxy/ substring of a URI apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default jackson-mapper-asl: XML external entity similar to CVE-2016-3720 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source cxf: OpenId Connect token service does not properly validate the clientId jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS jackson-databind: Serialization gadgets in classes of the commons-configuration package jackson-databind: Serialization gadgets in clas…