Open Source Vulnerabilities

gradle, wso2is, wso2is, wso2is

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc

wso2is, wso2is

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc

sonarqube, apache-hive, spark-sc213-jdk17-py312, apache-hive, apache-hive, apache-hive

yawkat LZ4 Java provides LZ4 compression for Java

sonarqube, apache-hive, spark-sc213-jdk17-py312, apache-hive, apache-hive, apache-hive

yawkat LZ4 Java provides LZ4 compression for Java

wso2is

Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check

wso2is, wso2is

Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions

wso2is, wso2is, wso2is

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3

gitea, gitea, prometheus, prometheus, cortex

Security fix for GO-2026-5932 applied in: gitea 1.26.4-r0, prometheus 3.5.3-r4, prometheus 3.12.0-r0, cortex 1.21.1-r3

wso2is, wso2is, wso2is

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper s...

wso2is, wso2is

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin...

gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

wso2is, wso2is, wso2is, wso2is, wso2is

mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource con...

gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

sonarqube, gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

sonarqube, gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

wso2is, wso2is, wso2is

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite

wso2is, wso2is, wso2is, wso2is

jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates

sonarqube, gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

wso2is, wso2is, wso2is, wso2is

JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates

spark-sc213-jdk17-py312, apache-hive, elasticsearch, elasticsearch, wso2is, kafka, strimzi-kafka-operator, apache-hive, wso2is, wso2is, wso2am, wso2is

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

wso2am

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1

sonarqube, gradle, spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, elasticsearch, elasticsearch, gradle, wso2is, wso2is, wso2is, wso2am, wso2is

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

apache-hive, apache-hive, wso2is, wso2am, wso2is

When audit logging is enabled (zookeeper

apache-hive, apache-hive, wso2is, wso2am, wso2is

unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

apache-hive, apache-hive, wso2is, wso2am, wso2is

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

apache-hive, apache-hive, wso2is, wso2am, wso2is

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

apache-hive, apache-hive, wso2is, wso2am, wso2is

`deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

gitea, gitea, cortex, cortex, cortex

Security fix for GHSA-mqqf-5wvp-8fh8 applied in: gitea 1.25.5-r0, cortex 1.21.0-r0, cortex 1.21.1-r2, cortex 1.21.1-r3

wso2is, wso2is, wso2is

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc

wso2is, wso2is, wso2is

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc

gradle, wso2is, wso2is

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, apache-hive, apache-hive

By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues

gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

gradle, gradle, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

rclone, prometheus, argo-cd-fips, cortex, cortex

Security fix for GHSA-cp6g-7hqx-qxhp applied in: rclone 1.73.5-r3, prometheus 3.5.3-r3, argo-cd-fips 3.3.7-r5, cortex 1.21.1-r2, cortex 1.21.1-r3

gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

gradle, spark-sc213-jdk17-py312, gradle, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

gradle, gradle, wso2is, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

wso2is, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

wso2is, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

wso2is, wso2is, wso2is, wso2is

In Bouncy Castle for Java before 1

ollama-fips, ollama-fips

Security fix for GHSA-w4gw-w5jq-g9jh applied in: ollama-fips 0.34.4-r2