infinispan

4 results · Feed

• Medium 5.5
  CVE-2025-5731

  Infinispan: credential leakage in infinispan cli

  A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8 Wolfi Maven
  Jun 26, 2025
• Medium 5.4
  CVE-2019-10158

  Improper implementation of the session fixation protection in Infinispan

  A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

  Red Hat infinispan org.infinispan:infinispan-core Maven
  Jan 2, 2020
• Medium 4.2
  CVE-2016-0750

  Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization

  The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or con…

  Red Hat infinispan org.infinispan:infinispan-core Maven
  Sep 11, 2018
• High 8.8
  CVE-2018-1131

  Deserialization of Untrusted Data in Infinispan

  Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects…

  Red Hat infinispan org.infinispan:infinispan-core Maven
  May 15, 2018