Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-W4JQ-QH47-HVJQ
HistoryFeb 15, 2022 - 1:37 a.m.

Improper Input Validation in Xerces

2022-02-1501:37:41
CWE-20
GitHub Advisory Database
github.com
18

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

37.8%

JSON

A flaw was found in Wildfly’s implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the “use-grammar-pool-only” feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. All xerces jboss versions before 2.12.0.SP3.

CPENameOperatorVersion
xerces:xercesimplle2.12.0.sp2

Related

cve 2
prion 2
redhatcve 2
osv 2
veracode 2
f5 1
debiancve 1
ibm 63
alpinelinux 1
ubuntucve 1
redhat 18
nessus 58
openvas 23
rosalinux 1
oraclelinux 5
amazon 3
centos 3
mageia 1
fedora 4
suse 2
gentoo 1
ubuntu 2
debian 1
cve
cve
CVE-2020-14338
2020-09-17 15:15:00
CVE-2020-14621
2020-07-15 18:15:00
prion
prion
Design/Logic Flaw
2020-09-17 15:15:00
Code injection
2020-07-15 18:15:00
redhatcve
redhatcve
CVE-2020-14338
2020-08-27 13:38:09
CVE-2020-14621
2020-07-15 09:39:04
osv
osv
Improper Input Validation in Xerces
2022-02-15 01:37:41
openjdk-8 - security update
2020-08-13 00:00:00
veracode
veracode
Validation Bypass
2020-10-14 04:33:05
Authorization Bypass
2020-07-18 03:18:48
f5
f5
K55053009 : Oracle Java SE JAXP vulnerability CVE-2020-14621
2020-10-26 00:00:00
debiancve
debiancve
CVE-2020-14621
2020-07-15 18:15:00
ibm
ibm
Security Bulletin: A vulnerability in IBM Java affects IBM ILOG CPLEX Optimization Studio and IBM CPLEX Enterprise Server (CVE-2020-14621)
2020-11-12 15:41:17
Security Bulletin: Vulnerability in IBM Java SDK affect IBM Content Classification
2020-11-27 18:38:02
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM InfoSphere Global Name Management (CVE-2020-14621, CVE-2020-14577)
2022-04-20 17:04:55
alpinelinux
alpinelinux
CVE-2020-14621
2020-07-15 18:15:00
ubuntucve
ubuntucve
CVE-2020-14621
2020-07-14 00:00:00
redhat
redhat
(RHSA-2021:0600) Important: Red Hat Process Automation Manager 7.10.0 security update
2021-02-17 10:00:13
(RHSA-2020:4247) Moderate: Red Hat JBoss Enterprise Application Platform 7.3.3 security update
2020-10-13 16:44:32
(RHSA-2020:4246) Moderate: Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 7
2020-10-13 16:39:17
nessus
nessus
RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 7 (Moderate) (RHSA-2020:4246)
2023-01-23 00:00:00
RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 6 (Moderate) (RHSA-2020:4244)
2020-10-14 00:00:00
RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 8 (Moderate) (RHSA-2020:4245)
2020-10-14 00:00:00
openvas
openvas
Huawei EulerOS: Security Advisory for java-1.8.0-openjdk (EulerOS-SA-2021-1877)
2021-05-19 00:00:00
Oracle Java SE Security Updates - 03 - (cpujul2020) - Linux
2021-08-25 00:00:00
Oracle Java SE Security Updates - 03 - (cpujul2020) - Windows
2021-08-25 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2023-2315
2023-12-19 12:25:07
oraclelinux
oraclelinux
java-1.8.0-openjdk security update
2020-07-18 00:00:00
java-11-openjdk security and enhancement update
2020-07-16 00:00:00
java-11-openjdk security update
2020-07-18 00:00:00
amazon
amazon
Important: java-1.8.0-openjdk
2020-09-15 18:00:00
Important: java-1.8.0-openjdk
2020-09-14 20:58:00
Important: java-11-amazon-corretto
2020-07-14 23:04:00
centos
centos
java security update
2020-08-07 12:59:34
java security update
2020-08-07 12:29:25
java security update
2020-08-07 12:30:19
mageia
mageia
Updated java-1.8.0-openjdk packages fix security vulnerability
2020-08-01 02:25:42
fedora
fedora
[SECURITY] Fedora 32 Update: java-11-openjdk-11.0.8.10-2.fc32
2020-07-24 01:15:49
[SECURITY] Fedora 32 Update: java-1.8.0-openjdk-1.8.0.262.b10-1.fc32
2020-07-23 01:07:12
[SECURITY] Fedora 31 Update: java-1.8.0-openjdk-1.8.0.262.b10-1.fc31
2020-07-28 15:03:32
suse
suse
Security update for java-11-openjdk (important)
2020-08-10 00:00:00
Security update for java-11-openjdk (important)
2020-08-12 00:00:00
gentoo
gentoo
OpenJDK: Multiple vulnerabilities
2020-08-30 00:00:00
ubuntu
ubuntu
OpenJDK vulnerabilities
2020-07-23 00:00:00
OpenJDK 8 vulnerabilities
2020-08-05 00:00:00
debian
debian
[SECURITY] [DLA 2325-1] openjdk-8 security update
2020-08-13 10:07:24

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

37.8%

JSON
Related for GHSA-W4JQ-QH47-HVJQ
cve2prion2redhatcve2osv2veracode2f51debiancve1ibm63alpinelinux1ubuntucve1redhat18nessus58openvas23rosalinux1oraclelinux5amazon3centos3mageia1fedora4suse2gentoo1ubuntu2debian1