Apache Karaf

2 results · Clear filters · Feed

• Medium 5.3
  CVE-2022-22932 Public exploit

  Path traversal flaws

  Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: htt…

  Apache Software Foundation Apache Karaf org.apache.karaf:apache-karaf Maven
  Jan 26, 2022
• Critical 9.8
  CVE-2018-11788 Public exploit

  XML External Entity Reference in Apache Karaf

  Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitiga…

  Apache Software Foundation Apache Karaf org.apache.karaf.specs:org.apache.karaf.specs.java.xml Maven
  Jan 7, 2019