https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:25:26 +0000 https://cve.radiocsirt.org/vuln/bdu:2020-02563 bdu:2020-02563 https://cve.radiocsirt.org/vuln/bdu:2020-02563 https://cve.radiocsirt.org/vuln/certfr-2020-avi-587 certfr-2020-avi-587 https://cve.radiocsirt.org/vuln/certfr-2020-avi-587 https://cve.radiocsirt.org/vuln/cnvd-2019-16273 cnvd-2019-16273 https://cve.radiocsirt.org/vuln/cnvd-2019-16273 https://cve.radiocsirt.org/vuln/euvd-2026-48379 EUVD-2026-48379 https://cve.radiocsirt.org/vuln/euvd-2026-48379 https://cve.radiocsirt.org/vuln/fkie_cve-2019-0201 <p>An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.</p> <p>An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-0201 https://cve.radiocsirt.org/vuln/ghsa-2hw2-62cp-p9p7 <p><strong>Affected:</strong> Maven: org.apache.zookeeper:zookeeper</p> <p>An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL() command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.</p> <p><strong>Affected:</strong> Maven: org.apache.zookeeper:zookeeper</p> <p>An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL() command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.</p> https://cve.radiocsirt.org/vuln/ghsa-2hw2-62cp-p9p7 https://cve.radiocsirt.org/vuln/gsd-2019-0201 gsd-2019-0201 https://cve.radiocsirt.org/vuln/gsd-2019-0201 https://cve.radiocsirt.org/vuln/rhsa-2019:3140 <p>thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis thrift: Improper Access Control grants access to files outside the webservers docroot path jackson-databind: improper polymorphic deserialization of types from Jodd-db library jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver jackson-databind: arbitrary code execution in slf4j-ext class jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes jackson-databind: improper polymorphic deserialization in axis2-transport-jms class jackson-databind: improper polymorphic deserialization in openjpa class jackson-databind: improper polymorphic deserialization in jboss-common-core class zookeeper: Information disclosure in Apache ZooKeeper</p> <p>thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis thrift: Improper Access Control grants access to files outside the webservers docroot path jackson-databind: improper polymorphic deserialization of types from Jodd-db library jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver jackson-databind: arbitrary code execution in slf4j-ext class jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes jackson-databind: improper polymorphic deserialization in axis2-transport-jms class jackson-databind: improper polymorphic deserialization in openjpa class jackson-databind: improper polymorphic deserialization in jboss-common-core class zookeeper: Information disclosure in Apache ZooKeeper</p> https://cve.radiocsirt.org/vuln/rhsa-2019:3140 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-0201 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: zookeeper, Ubuntu:Pro:16.04:LTS: zookeeper</p> <p>An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: zookeeper, Ubuntu:Pro:16.04:LTS: zookeeper</p> <p>An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-0201 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0770 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erhöhen oder einen Denial of Service zu verursachen</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erhöhen oder einen Denial of Service zu verursachen</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0770