Filtered by vendor Redhat Subscriptions
Filtered by product Hibernate Validator Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-7536 1 Redhat 9 Enterprise Linux, Hibernate Validator, Jboss Amq and 6 more 2024-09-16 7.0 High
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
CVE-2014-3558 1 Redhat 6 Hibernate Validator, Jboss Bpms, Jboss Brms and 3 more 2024-08-06 N/A
ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.
CVE-2019-10219 3 Netapp, Oracle, Redhat 199 Active Iq Unified Manager, Element, Management Services For Element Software And Netapp Hci and 196 more 2024-08-04 6.1 Medium
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
CVE-2020-10693 4 Ibm, Oracle, Quarkus and 1 more 13 Websphere Application Server, Weblogic Server, Quarkus and 10 more 2024-08-04 5.3 Medium
A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.