Vulnerabilities > Quarkus > Quarkus > 1.3.4

DATE CVE VULNERABILITY TITLE RISK
2020-12-03 CVE-2020-25649 XXE vulnerability in multiple products
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.
7.5
2020-12-02 CVE-2020-13956 Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
network
low complexity
apache quarkus oracle netapp
5.3
2020-12-02 CVE-2020-25638 A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final.
network
high complexity
hibernate debian quarkus oracle
7.4
2020-09-18 CVE-2020-25633 Information Exposure Through an Error Message vulnerability in multiple products
A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final.
network
low complexity
redhat quarkus CWE-209
5.3
2020-07-06 CVE-2019-14900 SQL Injection vulnerability in multiple products
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1.
network
low complexity
hibernate redhat quarkus CWE-89
6.5
2020-06-04 CVE-2020-13692 XXE vulnerability in multiple products
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
7.7
2020-05-13 CVE-2020-1714 Improper Input Validation vulnerability in multiple products
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks.
network
low complexity
redhat quarkus CWE-20
8.8
2020-05-06 CVE-2020-10693 A flaw was found in Hibernate Validator version 6.1.2.Final.
network
low complexity
redhat ibm quarkus oracle
5.3
2020-04-06 CVE-2020-1728 Improper Restriction of Rendered UI Layers or Frames vulnerability in multiple products
A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses.
network
low complexity
redhat quarkus CWE-1021
5.4
2019-12-12 CVE-2017-18640 XML Entity Expansion vulnerability in multiple products
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
7.5