Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

90 records

TI-2022-07142 CVE-2022-22965 · GHSA-36p3-wjmg-h94x

Code injection in Spring Framework

Priority CRITICAL 100KEV

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99638 Published 2022-04-01 Partial fix · 5.2.20.RELEASE, 5.3.18 +2 CWE-94
TI-2022-07140 CVE-2022-22963 · GHSA-6v73-fgf6-w5j7

Code injection in Spring Cloud Function

Priority CRITICAL 100KEV

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in rem…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99938 Published 2022-04-01 Fixed in 3.2.3, 3.1.7 CWE-94
TI-2022-08542 CVE-2022-24728 · GHSA-4fc4-4p5g-6w89

Cross-site Scripting in CKEditor4

Priority LOW 27

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01203 Published 2022-03-16 Fixed in 4.18.0 CWE-79
Priority MEDIUM 42

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.11615 Published 2022-01-24 Partial fix · 2.12.2 CWE-835
Priority LOW 36

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.06201 Published 2021-09-22 Partial fix · 2.6.3, 2.7.2 +1 CWE-203
Load more