Latest infinispan infinispan Vulnerabilities

● CVE-2023-5384

Infinispan: credentials returned from configuration as clear text

<8.4.6

● CVE-2023-5236

Infinispan: circular reference on marshalling leads to dos

<8.4.4

● CVE-2023-3629

Infinispan: non-admins should not be able to get cache config via rest api

<8.4.4

● CVE-2023-3628

Infispan: rest bulk ops don't check permissions

<8.4.4

● CVE-2020-25711

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can ...

redhat/Infinispan<11.0.6

Infinispan Infinispan<11.0.6

Redhat Data Grid=8.0

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vmware Vsphere

Netapp Active Iq Unified Manager Windows

● CVE-2019-10158

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

<=9.4.14

=7.0.0

Infinispan Infinispan<=9.4.14

Redhat Jboss Data Grid=7.0.0

maven/org.infinispan:infinispan-core<9.4.15.Final

● CVE-2019-10174

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's...

redhat/eap7-glassfish-jsf<0:2.3.5-11.SP3_redhat_00009.1.el6ea

redhat/eap7-infinispan<0:9.3.9-1.Final_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-11.SP3_redhat_00009.1.el7ea

redhat/eap7-infinispan<0:9.3.9-1.Final_redhat_00001.1.el7ea

redhat/eap7-glassfish-jsf<0:2.3.5-11.SP3_redhat_00009.1.el8ea

redhat/eap7-infinispan<0:9.3.9-1.Final_redhat_00001.1.el8ea

and 17 more

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.