Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.infinispan:infinispan-core

7 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 high, 2 medium
Registry
Maven Central

Advisories 7

  • Infinispan: credentials returned from configuration as clear text

    Affected: from 15.0.0.Dev01, fixed in 15.0.0.Dev07; fixed in 14.0.25.Final.

  • A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management…

    Affected: fixed in 11.0.6.Final.

  • CVE-2019-10158Medium 5.4

    A flaw was found in Infinispan through version 9.4.14.Final.

    Affected: fixed in 9.4.15.Final.

  • A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application…

    Affected: fixed in 8.2.12.Final; from 9.0.0.Final, fixed in 9.4.17.Final.

  • CVE-2016-0750Medium 4.2

    The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events.

    Affected: fixed in 9.1.0.Final.

  • Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations.

    Affected: versions 8.2.10.Final; versions 9.0.3.Final; versions 9.1.7.Final; versions 9.2.2.Final; from 9.3.0.Alpha1, fixed in 9.3.1.Final.

  • It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache.

    Affected: fixed in 9.2.0.CR1.