K11522001: Apache vulnerabilities CVE-2018-1313, CVE-2018-1338, CVE-2018-1339, CVE-2018-1335, and CVE-2018-8003

🗓️ 21 Feb 2023 19:58:14Reported by f5Type

f5🔗 my.f5.com👁 79 Views

Apache vulnerabilities in Derby, Tika, and Ambari. Network packet can boot user-controlled database in Derby Network Server, leading to infinite loop triggers in Apache Tika's BPGParser and ChmParser, and command injection in tika-server. Apache Ambari susceptible to directory traversal attack

Reporter	Title	Published	Views	Family All 119
Gitee	Exploit for Code Injection in Pivotal_Software Spring_Data_Commons	11 Apr 202111:34	–	gitee
0day.today	Apache Tika-server < 1.18 - Command Injection Exploit	13 Mar 201900:00	–	zdt
0day.today	Apache Tika 1.15 - 1.17 - Header Command Injection Exploit	5 Aug 201900:00	–	zdt
IBM Security Bulletins	Security Bulletin: A denial-of-service attack, heap use after free, network server exploit, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	8 Jul 202517:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilites affect IBM Engineering products.	26 Feb 202120:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for June 2024 - Multiple CVEs addressed	7 Aug 202405:53	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Derby security vulnerabilities in IBM System Dashboard for Enterprise Content Manager (affected, not vulnerable)	26 Jul 202223:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Open Source software used by Cloud Pak System	31 Mar 202314:10	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Derby as used by IBM QRadar SIEM is vulnerable to Improper Input Validation (CVE-2018-1313)	13 Oct 202019:34	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Derby could affect IBM Performance Management products (CVE-2018-1313)	29 Aug 201815:04	–	ibm

21 Feb 2023 19:58Current

6.5Medium risk

Vulners AI Score6.5

CVSS 29.3

CVSS 3.15.3

CVSS 38.1

EPSS0.93876