Nutch
Monthly
Unauthenticated remote code execution in the Apache Nutch Server (Nutch REST API) affects versions 1.10 through 1.22, combining a missing authorization check with unsafe reflection that lets externally-controlled input select and instantiate arbitrary classes. Any attacker able to reach an exposed Nutch Server endpoint can invoke functionality and drive class loading without credentials, yielding full compromise of the host. No public exploit identified at time of analysis and EPSS is low (0.36%), but the CVSS 9.8 rating and trivial network vector make exposed instances high priority.
Code injection via the Apache Nutch Server REST API allows low-privileged remote attackers to execute arbitrary code on hosts running Nutch versions 1.11 through 1.22. The vulnerability chains missing authorization controls with unsafe reflection and dynamic code execution in the Nutch REST API, enabling full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis; the vendor's definitive fix in version 1.23 removes the Nutch Server component entirely.
Missing authorization in the Apache Nutch Server (Nutch REST API) lets remote unauthenticated attackers read crawl data and interrupt or shut down running crawl jobs and their backing resources across Nutch 1.10 through 1.22. Because the REST API ships without access control, anyone able to reach the service can invoke management operations. No public exploit identified at time of analysis and EPSS is low (0.20%), but the fix is drastic: version 1.23 removes the Nutch Server component entirely.
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Unauthenticated remote code execution in the Apache Nutch Server (Nutch REST API) affects versions 1.10 through 1.22, combining a missing authorization check with unsafe reflection that lets externally-controlled input select and instantiate arbitrary classes. Any attacker able to reach an exposed Nutch Server endpoint can invoke functionality and drive class loading without credentials, yielding full compromise of the host. No public exploit identified at time of analysis and EPSS is low (0.36%), but the CVSS 9.8 rating and trivial network vector make exposed instances high priority.
Code injection via the Apache Nutch Server REST API allows low-privileged remote attackers to execute arbitrary code on hosts running Nutch versions 1.11 through 1.22. The vulnerability chains missing authorization controls with unsafe reflection and dynamic code execution in the Nutch REST API, enabling full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis; the vendor's definitive fix in version 1.23 removes the Nutch Server component entirely.
Missing authorization in the Apache Nutch Server (Nutch REST API) lets remote unauthenticated attackers read crawl data and interrupt or shut down running crawl jobs and their backing resources across Nutch 1.10 through 1.22. Because the REST API ships without access control, anyone able to reach the service can invoke management operations. No public exploit identified at time of analysis and EPSS is low (0.20%), but the fix is drastic: version 1.23 removes the Nutch Server component entirely.
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.