CVE-2020-11987High· 8.2▾ TwilightApache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying serve…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 2.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
13%
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
batik <= 1.13fedora = 33fedora = 34agile_engineering_data_management = 6.2.1.0banking_apis = 18.3banking_apis = 19.1banking_apis = 19.2banking_apis = 20.1banking_apis = 21.1banking_digital_experience = 18.3banking_digital_experience = 19.1banking_digital_experience = 19.2banking_digital_experience = 20.1banking_digital_experience = 21.1communications_application_session_controller = 3.9m0p3communications_metasolv_solution = 6.3.0communications_metasolv_solution = 6.3.1communications_offline_mediation_controller = 12.0.0.3.0enterprise_repository = 11.1.1.7.0flexcube_universal_banking >= 14.1.0, <= 14.4.0fusion_middleware_mapviewer = 12.2.1.4.0instantis_enterprisetrack = 17.1instantis_enterprisetrack = 17.2instantis_enterprisetrack = 17.3insurance_policy_administration >= 11.0, <= 11.3.1product_lifecycle_analytics = 3.6.1retail_back_office = 14.1retail_central_office = 14.1retail_order_broker = 15.0retail_order_broker = 16.0retail_order_management_system_cloud_service = 19.5retail_point-of-service = 14.1retail_returns_management = 14.1weblogic_server = 12.2.1.3.0weblogic_server = 12.2.1.4.0weblogic_server = 14.1.1.0.0debian_linux = 10.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2020-13956Medium· 5.3Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVE-2021-29425Medium· 4.8In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent di…
CVE-2021-22924Low· 3.7libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it comp…
CVE-2018-7160High· 8.8The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution
CVE-2021-3572Medium· 5.7A flaw was found in python-pip in the way it handled Unicode separators in git references
CVE-2016-1182High· 8.2ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, …