RE
Product
Resteasy
18
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 5Medium 9Low 0
Watch
Add Resteasy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9606 | 8.1 | Mar 9 | JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an… Affected: through 3.1.1 |
| CVE-2018-1051 | 8.1 | Jan 25 | It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()` in YamlProvider Affected: 3.0.22; 3.1.2 |
| CVE-2020-14326 | 7.5 | Jun 2 | A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes Affected: 4.2.0 before 4.5.6 |
| CVE-2020-1695 | 7.5 | May 19 | A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning… Affected: 3.0.0 before 3.12.0; 4.0.0 before 4.6.0 |
| CVE-2016-6346 | 7.5 | Sep 7 | RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors Affected: All versions, or not specified |
| CVE-2016-6345 | 6.5 | Sep 7 | RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs Affected: All versions, or not specified |
| CVE-2021-20293 | 6.1 | Jun 10 | A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling… Affected: through 4.6.0 |
| CVE-2020-10688 | 6.1 | May 27 | A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the… Affected: before 3.11.1; 4.5.0 before 4.5.3 |
| CVE-2016-6347 | 6.1 | Apr 20 | Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: All versions, or not specified |
| CVE-2016-6348 | 6.1 | Apr 12 | JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack Affected: All versions, or not specified |
| CVE-2023-0482 | 5.5 | Feb 17 | In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that… Affected: 3.15.4; 4.7.7; 5.0.5; 6.2.2 |
| CVE-2021-20289 | 5.3 | Mar 26 | A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final Affected: through 4.6.0 |
| CVE-2020-25633 | 5.3 | Sep 18 | A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final Affected: before 3.14.0; 4.5.0 through 4.5.6 |
| CVE-2020-25724 | 4.3 | May 26 | A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided Affected: before 2.0.0; 2.0.0; 2.0.0 |
| CVE-2014-7839 | – | Nov 25 | DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to… Affected: 2.3.7; 3.0.9 |
| CVE-2014-3490 | – | Aug 19 | RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the… Affected: 2.3.1 through 2.3.7.2; 3.0.0 before 3.0.9; 3.0; 3.0; 3.0; 3.0; +3 more |
| CVE-2012-0818 | – | Nov 23 | RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack Affected: through 2.3.0; 1.0.0; 1.0.1; 1.0.2; 1.1; 1.2; +7 more |
| CVE-2011-5245 | – | Nov 23 | The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java… Affected: through 2.3.1; 1.0.0; 1.0.1; 1.0.2; 1.1; 1.2; +8 more |
Showing 18