Search for packages
| purl | pkg:maven/org.apache.tika/tika-app@1.16 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-1324
|
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field … | There are no reported fixed by versions. |
|
CVE-2016-1000342
|
In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on … | There are no reported fixed by versions. |
|
CVE-2020-9489
|
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also … | There are no reported fixed by versions. |
|
CVE-2020-1950
|
A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23. | There are no reported fixed by versions. |
|
CVE-2016-1000345
|
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For … | There are no reported fixed by versions. |
|
CVE-2017-12626
|
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing … | There are no reported fixed by versions. |
|
CVE-2019-10094
|
A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's … | There are no reported fixed by versions. |
|
CVE-2019-17573
|
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage … | There are no reported fixed by versions. |
|
CVE-2016-1000340
|
In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of … | There are no reported fixed by versions. |
|
CVE-2019-13990
|
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. | There are no reported fixed by versions. |
|
CVE-2016-1000346
|
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. … | There are no reported fixed by versions. |
|
CVE-2019-12406
|
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This … | There are no reported fixed by versions. |
|
CVE-2016-1000343
|
In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key … | There are no reported fixed by versions. |
|
CVE-2017-1000487
|
Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings. | There are no reported fixed by versions. |
|
CVE-2018-1000613
|
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 … | There are no reported fixed by versions. |
|
CVE-2019-17359
|
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant … | There are no reported fixed by versions. |
|
CVE-2018-1000180
|
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to … |
Vulnerable |
|
CVE-2019-12415
|
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted … | There are no reported fixed by versions. |
|
CVE-2018-11771
|
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail … | There are no reported fixed by versions. |
|
CVE-2016-1000341
|
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings … | There are no reported fixed by versions. |
|
CVE-2017-12624
|
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a … | There are no reported fixed by versions. |
|
CVE-2016-1000338
|
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on … | There are no reported fixed by versions. |
|
CVE-2015-6644
|
Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted … | There are no reported fixed by versions. |
|
CVE-2019-10088
|
A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should … | There are no reported fixed by versions. |
|
CVE-2016-1000339
|
In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due … | There are no reported fixed by versions. |
|
CVE-2018-1335
|
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to … | There are no reported fixed by versions. |
|
CVE-2018-11762
|
In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory … | There are no reported fixed by versions. |
|
CVE-2018-17197
|
A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of … | There are no reported fixed by versions. |
|
CVE-2018-12418
|
Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service … | There are no reported fixed by versions. |
|
CVE-2018-10237
|
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks … | There are no reported fixed by versions. |
|
CVE-2018-8017
|
In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser. | There are no reported fixed by versions. |
|
CVE-2016-1000344
|
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This … | There are no reported fixed by versions. |
|
CVE-2016-1000352
|
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This … | There are no reported fixed by versions. |
|
CVE-2022-33879
|
Inefficient Regular Expression Complexity The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we … |
Not vulnerable Not vulnerable |
|
CVE-2021-28657
|
Loop with Unreachable Exit Condition (Infinite Loop) A carefully crafted or corrupt file may trigger an infinite loop in Tika's … |
Vulnerable |
|
CVE-2018-11762
|
Path Traversal In a rare edge case where a user does not specify an extract directory on the commandline (`--extract-dir=`) … |
Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2011-1498
|
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to … | |
|
CVE-2018-5382
|
Bouncy Castle BKS version 1 keystore (BKS-V1) files use an HMAC that is only 16 bits long, which can allow … | |
|
CVE-2017-5644
|
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via … | |
|
CVE-2016-6809
|
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika … |