Most recent entries from all

bdu:2020-02260

cnvd-2019-41646

EUVD-2026-53429

fkie_cve-2019-10174

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

GHSA-h47x-2j37-fw5m — Use of Externally-Controlled Input to Select Classes or Code in Infinispan

Affected: Maven: org.infinispan:infinispan-core

gsd-2019-10174

OESA-2024-1667 — infinispan security update

Affected: openEuler:20.03-LTS-SP1: infinispan, openEuler:20.03-LTS-SP4: infinispan, openEuler:22.03-LTS: infinispan, openEuler:22.03-LTS-SP1: infinispan, openEuler:22.03-LTS-SP2: infinispan, openEuler:22.03-LTS-SP3: infinispan

Infinispan is an extremely scalable, highly available data grid platform - 100% open source, and written in Java. The purpose of Infinispan is to expose a data structure that is highly concurrent, designed ground-up to make the most of modern multi-processor/multi-core architectures while at the same time providing distributed cache capabilities. At its core Infinispan exposes a Cache interface which extends java.util.Map. It is also optionally is backed by a peer-to-peer network architecture to distribute state efficiently around a data grid. Security Fix(es): A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.(CVE-2019-10174)

RHSA-2019:3901 — Red Hat Security Advisory: Red Hat OpenShift Application Runtimes Vert.x 3.8.3 security update

infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution jackson-databind: default typing mishandling leading to remote code execution netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource jackson-databind: Serialization gadgets in classes of the ehcache package

WID-SEC-W-2024-1926 — Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform auf Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen preiszugeben, Dateien und Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.