com.hazelcast:hazelcast (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package com.hazelcast:hazelcast, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (7)

• CVE-2022-0265 — CVSS 9.8 (critical): Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.
• CVE-2022-36437 — CVSS 9.1 (critical): The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster…
• CVE-2023-33265 — CVSS 8.8 (high): In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing…
• CVE-2016-10750 — CVSS 8.1 (high): In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can…
• CVE-2023-45859 — CVSS 7.6 (high): In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client…
• CVE-2023-45860 — CVSS 6.5 (medium): In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises…
• CVE-2023-33264 — CVSS 4.3 (medium): In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member…