3 results · Clear filters · Feed
-
Critical —
Apache StreamPark (incubating): Authenticated system users could trigger remote command execution
In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful a…
-
Critical 9.1
Apache StreamPark (incubating): Logic error causing any account reset
Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, …
-
Critical 9.8
Apache StreamPark (incubating): Upload any file to any directory
Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high-risk files, and may upload them to any directory, Users of the affected versions should upgrade to …