QU
Product
Quarkus
49
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 21Medium 19Low 2
Watch
Add Quarkus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-20328 | 6.8 | Feb 25 | Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate Affected: before 1.13.3; 1.13.3 |
| CVE-2022-21363 | 6.6 | Jan 19 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J) Affected: before 2.7.0 |
| CVE-2021-43797 | 6.5 | Dec 9 | HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling Affected: before 2.5.3 |
| CVE-2019-14900 | 6.5 | Jul 6 | A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1 Affected: through 1.5.2 |
| CVE-2023-0044 | 6.1 | Feb 23 | If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure Affected: before 2.13.7 |
| CVE-2021-2471 | 5.9 | Oct 20 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J) Affected: before 2.2.4; 2.3.0 before 2.6.0 |
| CVE-2021-38153 | 5.9 | Sep 22 | Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more… Affected: before 2.2.4 |
| CVE-2021-21409 | 5.9 | Mar 30 | Possible request smuggling in HTTP/2 due missing validation of content-length Affected: through 1.13.7 |
| CVE-2021-21295 | 5.9 | Mar 9 | Possible request smuggling in HTTP/2 due missing validation Affected: through 1.13.7 |
| CVE-2021-29429 | 5.5 | Apr 12 | Information disclosure through temporary directory permissions Affected: through 2.2.3 |
| CVE-2021-21290 | 5.5 | Feb 8 | Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files Affected: through 1.13.7 |
| CVE-2020-1728 | 5.4 | Apr 6 | A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in… Affected: through 1.4.2 |
| CVE-2021-3642 | 5.3 | Aug 5 | A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if… Affected: through 2.1.4 |
| CVE-2021-28170 | 5.3 | May 26 | In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid Affected: before 2.3.0 |
| CVE-2021-20289 | 5.3 | Mar 26 | A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final Affected: before 1.13.4 |
| CVE-2020-13956 | 5.3 | Dec 2 | Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick… Affected: before 1.7.6 |
| CVE-2020-25633 | 5.3 | Sep 18 | A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final Affected: through 1.11.6 |
| CVE-2020-10693 | 5.3 | May 6 | A flaw was found in Hibernate Validator version 6.1.2.Final Affected: through 1.4.2 |
| CVE-2020-25724 | 4.3 | May 26 | A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided Affected: before 1.11.2 |
Showing 19