Apache Software Foundation Dubbo vulnerabilities

• apache dubbo Apache Dubbo: Bypass deny serialize list check in Apache Dubbo CVE-2023-46279 Fix available 9.8 CriticalDecember 15, 2023
• apache dubbo Bypass serialize checks in Apache Dubbo CVE-2023-29234 Fix available 9.8 CriticalDecember 15, 2023
• apache dubbo Apache Dubbo Deserialization Vulnerability Gadgets Bypass CVE-2023-23638 Public exploitFix available 5.0 MediumMarch 8, 2023
• apache dubbo Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass CVE-2022-39198 Fix available 9.8 CriticalOctober 18, 2022
• apache dubbo bypass of CVE-2021-25640 CVE-2022-24969 Fix available 6.1 MediumJune 6, 2022
• apache dubbo Dubbo Hessian cause RCE when parse error CVE-2021-43297 Public exploitFix available EPSS 17.4% 9.8 CriticalJanuary 10, 2022
• apache dubbo Bypass deserialization checks in Apache Dubbo CVE-2021-37579 Fix available 9.8 CriticalSeptember 9, 2021
• apache dubbo Unprotected input value toString cause RCE CVE-2021-36161 Fix available 9.8 CriticalSeptember 9, 2021
• apache dubbo Unsafe deserialization in providers using the Hessian protocol CVE-2021-36163 Fix available 9.8 CriticalSeptember 7, 2021
• apache dubbo Unprotected yaml deserialization cause RCE CVE-2021-36162 Fix available 8.8 HighSeptember 7, 2021
• apache dubbo Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling) CVE-2021-30180 Public exploitFix available EPSS 60.3% 9.8 CriticalMay 31, 2021
• apache dubbo Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter CVE-2021-30179 Fix available 9.8 CriticalMay 31, 2021
• apache dubbo Open Redirect or SSRF vulnerability usage of parseURL CVE-2021-25640 Fix available 6.1 MediumMay 31, 2021
• apache dubbo Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection) CVE-2021-30181 Public exploitFix available EPSS 60.9% 9.8 CriticalMay 29, 2021
• apache dubbo Dubbo Zookeeper does not check serialization id CVE-2021-25641 Public exploitFix available EPSS 21.2% 9.8 CriticalMay 29, 2021
• apache dubbo Apache Dubbo default deserialization protocol Hessian2 cause CRE CVE-2020-11995 Fix available 9.8 CriticalJanuary 11, 2021
• apache dubbo Deserialization of Untrusted Data in Apache Dubbo CVE-2020-1948 Public exploitFix available EPSS 16.4% 9.8 CriticalJuly 14, 2020
• apache dubbo Deserialization of Untrusted Data in Apache Dubbo CVE-2019-17564 Public exploitFix available EPSS 36.5% 9.8 CriticalApril 1, 2020