sparkjava vulnerabilities

Products

• spark 2

Latest sparkjava CVEs

Newest publication first

1. CVE-2018-9159 Moderate severity vulnerability that affects com.sparkjava:spark-core

   Published 2018-03-31

   Medium·CVSS 5.3 EPSS 4.4%

   In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.

2. CVE-2016-9177 Spark allows remote attackers to read arbitrary files via a .. (dot dot) in the URI

   Published 2016-11-04

   High·CVSS 7.5 EPSS 5.1%

   Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.