cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2024-36265,https://securityvulnerability.io/vulnerability/CVE-2024-36265,Apache Submarine Server Core: authorization bypass,"An incorrect authorization vulnerability has been identified in Apache Submarine Server Core, affecting version 0.8.0 and later. As this project has been retired, no further support or patches will be provided to address this issue. Users operating this product are strongly advised to seek alternative solutions or implement stringent access restrictions to safeguard their instances. The lack of ongoing support emphasizes the importance of migrating to a maintained product to ensure continued protection against security threats.",Apache,Apache Submarine Server Core,9.8,CRITICAL,0.04235000163316727,false,,false,false,false,,,false,false,,2024-06-12T15:15:00.000Z,0
CVE-2024-36263,https://securityvulnerability.io/vulnerability/CVE-2024-36263,Apache Submarine Server Core: SQL injection,"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Submarine Server Core.

This issue affects Apache Submarine Server Core: all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

",Apache,Apache Submarine Server Core,,,0.00044999999227002263,false,,false,false,false,,,false,false,,2024-06-12T14:15:00.000Z,0
CVE-2023-37924,https://securityvulnerability.io/vulnerability/CVE-2023-37924,Apache Submarine: SQL injection from unauthorized login,"Apache Submarine is susceptible to an SQL injection vulnerability that occurs during user login. This issue can allow unauthorized users to gain access to the workbench without proper credentials. To mitigate this risk, users are strongly advised to upgrade from versions 0.7.0 to the fixed version 0.8.0, which not only resolves this vulnerability but also enhances security by supporting OIDC authentication mode and ensuring that unauthenticated logins are eliminated. For users unable to upgrade, cherry-picking specific pull requests and rebuilding the submarine-server image may serve as a temporary fix.",Apache,Apache Submarine,9.8,CRITICAL,0.006990000139921904,false,,false,false,false,,,false,false,,2023-11-22T10:15:00.000Z,0
CVE-2023-46302,https://securityvulnerability.io/vulnerability/CVE-2023-46302,Bug in Apache Submarine's YAML Serialization Using snakeyaml,"Apache Submarine contains a vulnerability related to improper YAML deserialization that arises from the use of SnakeYAML. The vulnerability is manifested when handling incoming requests using application/yaml content-type through the YamlEntityProvider entity provider. Specifically, an error occurs in the readFrom method, which processes user-supplied YAML data. This issue affects versions of Apache Submarine prior to 0.8.0. To remediate the vulnerability, users should upgrade to Apache Submarine version 0.8.0 or later. Alternatively, for users who cannot upgrade, a temporary fix can be applied by cherry-picking a patch from the project's repository and rebuilding the submarine-server image.",Apache,Apache Submarine,9.8,CRITICAL,0.0034099998883903027,false,,false,false,false,,,false,false,,2023-11-20T09:15:00.000Z,0