https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:06:33 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-03219 cnvd-2020-03219 https://cve.radiocsirt.org/vuln/cnvd-2020-03219 https://cve.radiocsirt.org/vuln/euvd-2026-35739 EUVD-2026-35739 https://cve.radiocsirt.org/vuln/euvd-2026-35739 https://cve.radiocsirt.org/vuln/fkie_cve-2020-1925 <p>Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.</p> <p>Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-1925 https://cve.radiocsirt.org/vuln/ghsa-v4qh-6367-4cx2 <p><strong>Affected:</strong> Maven: org.apache.olingo:odata-client-core</p> <p>Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.</p> <p><strong>Affected:</strong> Maven: org.apache.olingo:odata-client-core</p> <p>Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.</p> https://cve.radiocsirt.org/vuln/ghsa-v4qh-6367-4cx2 https://cve.radiocsirt.org/vuln/gsd-2020-1925 gsd-2020-1925 https://cve.radiocsirt.org/vuln/gsd-2020-1925 https://cve.radiocsirt.org/vuln/rhsa-2021:3140 <p>log4j: Socket receiver deserialization vulnerability snakeyaml: Billion laughs attack via alias feature apache-commons-compress: Infinite loop in name encoding algorithm wildfly: The &#39;enabled-protocols&#39; value in legacy security is not respected if OpenSSL security provider is in use netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class olingo-odata: Server side request forgery in AsyncResponseWrapperImpl tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack springframework: RFD protection bypass via jsessionid Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371 tomcat: deserialization flaw in session persistence storage leading to RCE RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack hibernate-validator: Improper input validation in the interpolation of constraint error messages wildfly-elytron: session fixation when using FORM authentication undertow: invalid HTTP request with large chunk size tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS a…</p> <p>log4j: Socket receiver deserialization vulnerability snakeyaml: Billion laughs attack via alias feature apache-commons-compress: Infinite loop in name encoding algorithm wildfly: The &#39;enabled-protocols&#39; value in legacy security is not respected if OpenSSL security provider is in use netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class olingo-odata: Server side request forgery in AsyncResponseWrapperImpl tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack springframework: RFD protection bypass via jsessionid Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371 tomcat: deserialization flaw in session persistence storage leading to RCE RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack hibernate-validator: Improper input validation in the interpolation of constraint error messages wildfly-elytron: session fixation when using FORM authentication undertow: invalid HTTP request with large chunk size tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS a…</p> https://cve.radiocsirt.org/vuln/rhsa-2021:3140