Apache Software Foundation Drill 1.16.0

CPE Details

Apache Software Foundation Drill 1.16.0
apache
drill
1.16.0
2021-02-16
17h27 +00:00
2021-03-18
10h29 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:apache:drill:1.16.0:*:*:*:*:*:*:*

Informations

Vendor

apache

Product

drill

Version

1.16.0

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2023-48362 2024-07-24 07h45 +00:00 XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.
9.8
Critique
CVE-2019-14439 2019-07-30 08h49 +00:00 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
7.5
Haute
CVE-2019-0201 2019-05-23 11h42 +00:00 An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
5.9
Moyen
CVE-2019-10241 2019-04-22 18h14 +00:00 In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
6.1
Moyen
CVE-2010-5312 2014-11-23 23h00 +00:00 Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
6.1
Moyen