Filtered by vendor Redhat Subscriptions
Filtered by product Apache Camel Spring Boot Subscriptions
Total 29 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-52428 2 Connect2id, Redhat 3 Nimbus Jose\+jwt, Apache Camel Spring Boot, Jboss Enterprise Application Platform 2024-11-21 7.5 High
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
CVE-2023-51079 2 Mvel, Redhat 2 Mvel, Apache Camel Spring Boot 2024-11-21 5.3 Medium
A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."
CVE-2023-44483 2 Apache, Redhat 6 Santuario Xml Security For Java, Apache Camel Spring Boot, Camel Quarkus and 3 more 2024-11-21 6.5 Medium
All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.
CVE-2022-45685 3 Debian, Jettison Project, Redhat 3 Debian Linux, Jettison, Apache Camel Spring Boot 2024-11-21 7.5 High
A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.
CVE-2022-34169 7 Apache, Azul, Debian and 4 more 23 Xalan-java, Zulu, Debian Linux and 20 more 2024-11-21 7.5 High
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
CVE-2024-52007 2 Hapifhir, Redhat 2 Hl7 Fhir Core, Apache Camel Spring Boot 2024-11-12 8.6 High
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 & #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-51132 2 Fhir, Redhat 3 Hapi Fhir, Apache Camel Spring Boot, Camel Quarkus 2024-11-06 9.8 Critical
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.
CVE-2024-38816 2 Redhat, Spring By Vmware Tanzu 3 Apache Camel Spring Boot, Rhboac Hawtio, Spring Framework 2024-09-13 7.5 High
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. Specifically, an application is vulnerable when both of the following are true: * the web application uses RouterFunctions to serve static resources * resource handling is explicitly configured with a FileSystemResource location However, malicious requests are blocked and rejected when any of the following is true: * the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use * the application runs on Tomcat or Jetty
CVE-2024-45294 1 Redhat 2 Apache Camel Spring Boot, Camel Quarkus 2024-09-06 8.6 High
The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available.