jackrabbit

3 results · Clear filters · Feed

• Medium 6.9
  CVE-2026-92415

  Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

  — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes fr…

  Apache Software Foundation Apache Jackrabbit jackrabbit jackrabbit Debian Ubuntu
  Oct 7, 2026
• Medium 6.5
  CVE-2025-58782

  Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory

  Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accep…

  Apache Software Foundation Apache Jackrabbit Core Apache Jackrabbit JCR Commons jackrabbit Debian Ubuntu Maven
  Sep 8, 2025
• Medium —
  CVE-2015-1833 Public exploit EPSS 56%

  Improper Input Validation in Apache Jackrabbit

  XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet …

  jackrabbit jackrabbit org.apache.jackrabbit:jackrabbit-core Debian Ubuntu Maven
  May 29, 2015