Apache Tapestry
10 CVEs affecting Apache Tapestry. Latest disclosed: 2022-12-02. Critical: 5, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-46366 | Critical | 9.8 | 2022-12-02 | Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, whic… |
CVE-2021-27850 | Critical | 9.8 | 2021-04-15 | A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5… |
CVE-2020-17531 | Critical | 9.8 | 2020-12-08 | A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the pa… |
CVE-2019-10071 | Critical | 9.8 | 2019-09-16 | The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC sign… |
CVE-2019-0195 | Critical | 9.8 | 2019-09-16 | Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the fil… |
CVE-2022-31781 | High | 7.5 | 2022-07-13 | Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Conten… |
CVE-2021-30638 | High | 7.5 | 2021-04-27 | Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constr… |
CVE-2019-0207 | High | 7.5 | 2019-09-16 | Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`… |
CVE-2020-13953 | Medium | 5.3 | 2020-09-30 | In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run. |
CVE-2014-1972 | | 2015-08-22 | Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to ca… |