org.apache.dubbo:dubbo vulnerabilities (Maven)

16 vulnerabilities.

• org.apache.dubbo:dubbo Maven Apache Dubbo: Bypass deny serialize list check in Apache Dubbo CVE-2023-46279 Fix available 9.8 CriticalDecember 15, 2023
• org.apache.dubbo:dubbo Maven Bypass serialize checks in Apache Dubbo CVE-2023-29234 Fix available 9.8 CriticalDecember 15, 2023
• org.apache.dubbo:dubbo Maven Apache Dubbo Deserialization Vulnerability Gadgets Bypass CVE-2023-23638 Public exploitFix available 5.0 MediumMarch 8, 2023
• org.apache.dubbo:dubbo Maven Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass CVE-2022-39198 Fix available 9.8 CriticalOctober 18, 2022
• org.apache.dubbo:dubbo Maven bypass of CVE-2021-25640 CVE-2022-24969 Fix available 6.1 MediumJune 6, 2022
• org.apache.dubbo:dubbo Maven Dubbo Hessian cause RCE when parse error CVE-2021-43297 Public exploitFix available EPSS 17.4% 9.8 CriticalJanuary 10, 2022
• org.apache.dubbo:dubbo Maven Bypass deserialization checks in Apache Dubbo CVE-2021-37579 Fix available 9.8 CriticalSeptember 9, 2021
• org.apache.dubbo:dubbo Maven Unprotected input value toString cause RCE CVE-2021-36161 Fix available 9.8 CriticalSeptember 9, 2021
• org.apache.dubbo:dubbo Maven Unsafe deserialization in providers using the Hessian protocol CVE-2021-36163 Fix available 9.8 CriticalSeptember 7, 2021
• org.apache.dubbo:dubbo Maven Unprotected yaml deserialization cause RCE CVE-2021-36162 Fix available 8.8 HighSeptember 7, 2021
• org.apache.dubbo:dubbo Maven Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling) CVE-2021-30180 Public exploitFix available EPSS 60.3% 9.8 CriticalMay 31, 2021
• org.apache.dubbo:dubbo Maven Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter CVE-2021-30179 Fix available 9.8 CriticalMay 31, 2021
• org.apache.dubbo:dubbo Maven Open Redirect or SSRF vulnerability usage of parseURL CVE-2021-25640 Fix available 6.1 MediumMay 31, 2021
• org.apache.dubbo:dubbo Maven Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection) CVE-2021-30181 Public exploitFix available EPSS 60.9% 9.8 CriticalMay 29, 2021
• org.apache.dubbo:dubbo Maven Dubbo Zookeeper does not check serialization id CVE-2021-25641 Public exploitFix available EPSS 21.2% 9.8 CriticalMay 29, 2021
• org.apache.dubbo:dubbo Maven Deserialization of Untrusted Data in Apache Dubbo CVE-2020-1948 Public exploitFix available EPSS 16.4% 9.8 CriticalJuly 14, 2020