Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Hutool Subscribe
Filtered by product Hutool
Total 8 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-45688 2 Hutool, Json-java Project 2 Hutool, Json-java 2023-03-09 N/A 7.5 HIGH
A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
CVE-2023-24162 1 Hutool 1 Hutool 2023-02-07 N/A 9.8 CRITICAL
Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.
CVE-2023-24163 1 Hutool 1 Hutool 2023-02-07 N/A 9.8 CRITICAL
SQL Inection vulnerability in Dromara hutool v5.8.11 allows attacker to execute arbitrary code via the aviator template engine.
CVE-2022-4565 1 Hutool 1 Hutool 2022-12-22 N/A 7.5 HIGH
A vulnerability classified as problematic was found in Dromara HuTool up to 5.8.10. This vulnerability affects unknown code of the file cn.hutool.core.util.ZipUtil.java. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.11 is able to address this issue. It is recommended to upgrade the affected component. VDB-215974 is the identifier assigned to this vulnerability.
CVE-2022-45690 1 Hutool 1 Hutool 2022-12-15 N/A 7.5 HIGH
A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
CVE-2022-45689 1 Hutool 1 Hutool 2022-12-15 N/A 7.5 HIGH
hutool-json v5.8.10 was discovered to contain an out of memory error.
CVE-2022-22885 1 Hutool 1 Hutool 2022-02-25 7.5 HIGH 9.8 CRITICAL
Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.
CVE-2018-17297 1 Hutool 1 Hutool 2018-11-26 6.4 MEDIUM 7.5 HIGH
The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.