| CVE-2025-53960 |
When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g.,…
|
Not rated
|
Dec 12, 2025 |
| CVE-2025-54947 |
In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists
|
Not rated
|
Dec 12, 2025 |
| CVE-2025-54981 |
Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for…
|
Not rated
|
Dec 12, 2025 |
| CVE-2025-30001 |
Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark
|
Not rated
|
Oct 10, 2025 |
| CVE-2024-48988 |
SQL Injection vulnerability in Apache StreamPark
|
Not rated
|
Aug 22, 2025 |
| CVE-2024-29070 |
On versions before 2.1.4, session is not invalidated after logout
|
Not rated
|
Jul 23, 2024 |
| CVE-2024-34457 |
On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the…
|
Not rated
|
Jul 22, 2024 |
| CVE-2024-29178 |
On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution…
|
Not rated
|
Jul 18, 2024 |
| CVE-2024-29120 |
In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as…
|
Not rated
|
Jul 17, 2024 |