Browse CVEs

MEDIUM 5.5 CVE-2023-33251 When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak pe… Akka Http 10.5.2+ Fix from $1,6002023-05-21 HIGH 7.5 CVE-2023-31442 In Lightbend Akka before 2.8.1, the async-dns resolver (used by Discovery in DNS mode and transitively by Cluster Bootstrap) uses predictable DNS tra… Akka Actor 2.8.1+ Fix from $1,9502023-05-11 MEDIUM 5.5 CVE-2023-29471 Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext logi… Alpakka Kafka 4.0.2+ Fix from $1,6002023-04-27 HIGH 7.5 CVE-2022-31023 Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive inf… Play Framework 2.8.16+ Fix from $1,9502022-06-02 HIGH 7.5 CVE-2022-31018 Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's… Play Framework after 2.8.15 Fix from $1,9502022-06-02 MEDIUM 6.5 CVE-2021-23339 This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding … Akka Http 10.1.14 / 10.2.4+ Fix from $1,6002021-02-17 HIGH 7.5 CVE-2020-26882 In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input. Play Framework after 2.8.2 Fix from $1,9502020-11-06 HIGH 7.5 CVE-2020-26883 In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents. Play Framework after 2.8.2 Fix from $1,9502020-11-06 HIGH 7.5 CVE-2020-27196 An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content… Play Framework after 2.8.2 Fix from $1,9502020-11-06 MEDIUM 6.5 CVE-2020-12480 In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that… Play Framework after 2.8.1 Fix from $1,6002020-08-17 HIGH 7.5 CVE-2019-17598 An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws… Play Framework after 2.6.23 Fix from $1,9502019-11-05 HIGH 7.5 CVE-2018-18853 Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexit… Spray Json after 1.3.4 Fix from $1,9502018-10-31 HIGH 7.5 CVE-2018-18854 Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexit… Spray Json after 1.3.4 Fix from $1,9502018-10-31 HIGH 7.5 CVE-2018-16131 The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to … Akka Http after 10.1.4 Fix from $1,9502018-08-30 CRITICAL 9.1 CVE-2018-16115 Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remo… Akka 2.5.16+ Fix from $2,3002018-08-29 HIGH 7.5 CVE-2018-13864 A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on… Play Framework after 2.6.15 Fix from $1,9502018-07-17 CRITICAL 9.8 CVE-2014-3630 XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attac… Play Framework Mitigation only Fix from $2,3002017-12-29