Apache Software Foundation Camel 2.15.0

CPE Details

Apache Software Foundation Camel 2.15.0
apache
camel
2.15.0
2016-04-25
11h58 +00:00
2016-04-25
11h58 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:apache:camel:2.15.0:*:*:*:*:*:*:*

Informations

Vendor

apache

Product

camel

Version

2.15.0

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2019-0188 2019-05-28 16h10 +00:00 Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.
7.5
High
CVE-2019-0194 2019-04-30 19h30 +00:00 Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.
7.5
High
CVE-2017-12633 2017-11-15 15h00 +00:00 The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
9.8
Critical
CVE-2017-12634 2017-11-15 15h00 +00:00 The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
9.8
Critical
CVE-2017-5643 2017-03-16 14h00 +00:00 Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
7.4
High
CVE-2015-5348 2016-04-15 13h00 +00:00 Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
8.1
High
CVE-2015-5344 2016-02-03 14h00 +00:00 The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
9.8
Critical