Apache / Dubbo
19 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2023-46279 | Apache Dubbo: Bypass deny serialize list check in Apache Dubbo | CRITICAL | 9.8 | Dec 15, 2023 |
| CVE-2023-29234 | Bypass serialize checks in Apache Dubbo | CRITICAL | 9.8 | Dec 15, 2023 |
| CVE-2023-23638 | Apache Dubbo Deserialization Vulnerability Gadgets Bypass | CRITICAL | 9.8 | Mar 8, 2023 |
| CVE-2021-32824 | Regular expression Denial of Service in MooTools | CRITICAL | 9.8 | Jan 3, 2023 |
| CVE-2022-39198 | Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass | CRITICAL | 9.8 | Oct 18, 2022 |
| CVE-2022-24969 | bypass of CVE-2021-25640 | MEDIUM | 6.1 | Jun 6, 2022 |
| CVE-2021-43297 | Dubbo Hessian cause RCE when parse error | CRITICAL | 9.8 | Jan 10, 2022 |
| CVE-2021-37579 | Bypass deserialization checks in Apache Dubbo | CRITICAL | 9.8 | Sep 9, 2021 |
| CVE-2021-36161 | Unprotected input value toString cause RCE | CRITICAL | 9.8 | Sep 9, 2021 |
| CVE-2021-36163 | Unsafe deserialization in providers using the Hessian protocol | CRITICAL | 9.8 | Sep 7, 2021 |
| CVE-2021-36162 | Unprotected yaml deserialization cause RCE | HIGH | 8.8 | Sep 7, 2021 |
| CVE-2021-30180 | Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling) | CRITICAL | 9.8 | May 31, 2021 |
| CVE-2021-30179 | Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter | CRITICAL | 9.8 | May 31, 2021 |
| CVE-2021-25640 | Open Redirect or SSRF vulnerability usage of parseURL | MEDIUM | 6.1 | May 31, 2021 |
| CVE-2021-30181 | Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection) | CRITICAL | 9.8 | May 29, 2021 |
| CVE-2021-25641 | Dubbo Zookeeper does not check serialization id | CRITICAL | 9.8 | May 29, 2021 |
| CVE-2020-11995 | Apache Dubbo default deserialization protocol Hessian2 cause CRE | CRITICAL | 9.8 | Jan 11, 2021 |
| CVE-2020-1948 | This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name a… | CRITICAL | 9.8 | Jul 14, 2020 |
| CVE-2019-17564 | Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to com… | CRITICAL | 9.8 | Apr 1, 2020 |
Showing 1 to 19 of 19 CVEs