| Max CVSS | 7.5 | Min CVSS | 5.0 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2013-4330 | 6.8 |
Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.
|
13-02-2023 - 04:46 | 04-10-2013 - 17:55 | |
| CVE-2014-0003 | 7.5 |
The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.
|
13-02-2023 - 00:29 | 21-03-2014 - 04:38 | |
| CVE-2014-0002 | 7.5 |
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an
|
13-02-2023 - 00:29 | 21-03-2014 - 04:38 | |
| CVE-2018-8027 | 7.5 |
Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.
|
24-05-2019 - 11:29 | 31-07-2018 - 13:29 | |
| CVE-2018-8041 | 5.0 |
Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.
|
24-05-2019 - 11:29 | 17-09-2018 - 14:29 | |
| CVE-2017-5643 | 5.8 |
Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
|
24-05-2019 - 11:29 | 16-03-2017 - 15:59 | |
| CVE-2017-3159 | 7.5 |
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.
|
24-05-2019 - 11:29 | 07-03-2017 - 15:59 | |
| CVE-2016-8749 | 7.5 |
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.
|
24-05-2019 - 11:29 | 28-03-2017 - 18:59 | |
| CVE-2015-5348 | 6.8 |
Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java objec
|
24-05-2019 - 11:29 | 15-04-2016 - 15:59 | |
| CVE-2015-5344 | 7.5 |
The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
|
24-05-2019 - 11:29 | 03-02-2016 - 18:59 | |
| CVE-2017-12634 | 7.5 |
The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
|
24-05-2019 - 11:29 | 15-11-2017 - 15:29 | |
| CVE-2017-12633 | 7.5 |
The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
|
24-05-2019 - 11:29 | 15-11-2017 - 15:29 | |
| CVE-2015-0264 | 5.0 |
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) Gener
|
24-05-2019 - 11:29 | 03-06-2015 - 20:59 | |
| CVE-2015-0263 | 5.0 |
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource. <a h
|
24-05-2019 - 11:29 | 03-06-2015 - 20:59 | |
| CVE-2019-0194 | 5.0 |
Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.
|
24-05-2019 - 11:29 | 30-04-2019 - 22:29 |