https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 08:14:14 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-02253 bdu:2024-02253 https://cve.radiocsirt.org/vuln/bdu:2024-02253 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0337 certfr-2023-avi-0337 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0337 https://cve.radiocsirt.org/vuln/euvd-2026-236524 EUVD-2026-236524 https://cve.radiocsirt.org/vuln/euvd-2026-236524 https://cve.radiocsirt.org/vuln/fkie_cve-2022-37866 <p>When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied &#34;pattern&#34; that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain &#34;../&#34; sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy&#39;s local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing &#34;..&#34; sequences and a &#34;normal&#34; repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.</p> <p>When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied &#34;pattern&#34; that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain &#34;../&#34; sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy&#39;s local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing &#34;..&#34; sequences and a &#34;normal&#34; repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-37866 https://cve.radiocsirt.org/vuln/ghsa-wv7w-rj2x-556x <p><strong>Affected:</strong> Maven: org.apache.ivy:ivy</p> <p>When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied &#34;pattern&#34; that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain &#34;../&#34; sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy&#39;s local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing &#34;..&#34; sequences and a &#34;normal&#34; repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy versions 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.</p> <p><strong>Affected:</strong> Maven: org.apache.ivy:ivy</p> <p>When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied &#34;pattern&#34; that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain &#34;../&#34; sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy&#39;s local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing &#34;..&#34; sequences and a &#34;normal&#34; repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy versions 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.</p> https://cve.radiocsirt.org/vuln/ghsa-wv7w-rj2x-556x https://cve.radiocsirt.org/vuln/gsd-2022-37866 gsd-2022-37866 https://cve.radiocsirt.org/vuln/gsd-2022-37866 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12506-1 <p>apache-ivy-2.5.1-1.1 on GA media</p> <p>apache-ivy-2.5.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:12506-1 https://cve.radiocsirt.org/vuln/rhsa-2023:2100 <p>apache-commons-net: FTP client trusts the host from PASV response by default undertow: Server identity in https connection is not checked by the undertow client snakeyaml: Denial of Service due to missing nested depth limitation for collections apache-spark: XSS vulnerability in log viewer UI Javascript Pulsar: Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM apache-ivy: Directory Traversal Ivy: Ivy Path traversal batik: Server-Side Request Forgery batik: Server-Side Request Forgery snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode scandium: Failing DTLS handshakes may cause throttling to block processing of records batik: Server-Side Request Forgery (SSRF) vulnerability jettison: memory exhaustion via user-supplied XML or JSON data xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks batik: Apache XML Graphics Batik vulnerable to code execution via SVG JXPath: untrusted XPath expressions may lead to RCE attack hsqldb: Untrusted input may lead to RC…</p> <p>apache-commons-net: FTP client trusts the host from PASV response by default undertow: Server identity in https connection is not checked by the undertow client snakeyaml: Denial of Service due to missing nested depth limitation for collections apache-spark: XSS vulnerability in log viewer UI Javascript Pulsar: Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM apache-ivy: Directory Traversal Ivy: Ivy Path traversal batik: Server-Side Request Forgery batik: Server-Side Request Forgery snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode scandium: Failing DTLS handshakes may cause throttling to block processing of records batik: Server-Side Request Forgery (SSRF) vulnerability jettison: memory exhaustion via user-supplied XML or JSON data xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks batik: Apache XML Graphics Batik vulnerable to code execution via SVG JXPath: untrusted XPath expressions may lead to RCE attack hsqldb: Untrusted input may lead to RC…</p> https://cve.radiocsirt.org/vuln/rhsa-2023:2100 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1142 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Integration Camel for Spring Boot ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität zu gefährden.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Integration Camel for Spring Boot ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1142