Dropwizard

Dropwizard Validation

2 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9

CVE-2020-11002

Exploit
  • EPSS 1.26%
  • Published 10.04.2020 19:15:13
  • Last modified 21.11.2024 04:56:33

dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Re...

9

CVE-2020-5245

Exploit
  • EPSS 4.86%
  • Published 24.02.2020 18:15:22
  • Last modified 21.11.2024 05:33:45

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating fe...