logo
DATABASE RESOURCES PRICING ABOUT US

Security Bulletin: Multiple Vulnerabilities identified in IBM StoredIQ

2020-02-20T12:42:12

Description

## Summary Multiple vulnerabilities in bundled software packages affect IBM StoredIQ. IBM StoredIQ has addressed the applicable CVEs. ## Vulnerability Details **CVEID: **[CVE-2009-0217](<https://vulners.com/cve/CVE-2009-0217>) **DESCRIPTION: **The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits. CVSS Base score: 4.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/51716](<https://exchange.xforce.ibmcloud.com/vulnerabilities/51716>) for the current score. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) **CVEID: **[CVE-2012-5783](<https://vulners.com/cve/CVE-2012-5783>) **DESCRIPTION: **Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. CVSS Base score: 4.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/79984](<https://exchange.xforce.ibmcloud.com/vulnerabilities/79984>) for the current score. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) **CVEID: **[CVE-2012-2098](<https://vulners.com/cve/CVE-2012-2098>) **DESCRIPTION: **Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs. CVSS Base score: 5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/75857](<https://exchange.xforce.ibmcloud.com/vulnerabilities/75857>) for the current score. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) **CVEID: **[CVE-2017-3589](<https://vulners.com/cve/CVE-2017-3589>) **DESCRIPTION: **Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). CVSS Base score: 3.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/124962](<https://exchange.xforce.ibmcloud.com/vulnerabilities/124962>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) **CVEID: **[CVE-2017-3586](<https://vulners.com/cve/CVE-2017-3586>) **DESCRIPTION: **Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). CVSS Base score: 6.4 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/124960](<https://exchange.xforce.ibmcloud.com/vulnerabilities/124960>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) **CVEID: **[CVE-2017-3523](<https://vulners.com/cve/CVE-2017-3523>) **DESCRIPTION: **Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). CVSS Base score: 8.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/126183](<https://exchange.xforce.ibmcloud.com/vulnerabilities/126183>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) **CVEID: **[CVE-2014-0114](<https://vulners.com/cve/CVE-2014-0114>) **DESCRIPTION: **Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/92889](<https://exchange.xforce.ibmcloud.com/vulnerabilities/92889>) for the current score. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P) **CVEID: **[CVE-2010-1632](<https://vulners.com/cve/CVE-2010-1632>) **DESCRIPTION: **Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService. CVSS Base score: 5.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/59588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/59588>) for the current score. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:P) **CVEID: **[CVE-2009-2625](<https://vulners.com/cve/CVE-2009-2625>) **DESCRIPTION: **XMLScanner.java in Apache Xerces2 Java, asused in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework. CVSS Base score: 5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/53082](<https://exchange.xforce.ibmcloud.com/vulnerabilities/53082>) for the current score. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) **CVEID: **[CVE-2013-4002](<https://vulners.com/cve/CVE-2013-4002>) **DESCRIPTION: **XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause adenial of service via vectors related to XML attribute names. CVSS Base score: 7.1 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/85260](<https://exchange.xforce.ibmcloud.com/vulnerabilities/85260>) for the current score. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C) **CVEID: **[CVE-2012-0881](<https://vulners.com/cve/CVE-2012-0881>) **DESCRIPTION: **Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/134404](<https://exchange.xforce.ibmcloud.com/vulnerabilities/134404>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2015-6420](<https://vulners.com/cve/CVE-2015-6420>) **DESCRIPTION: **Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. CVSS Base score: 9.8 CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) **CVEID: **[CVE-2017-15708](<https://vulners.com/cve/CVE-2017-15708>) **DESCRIPTION: **In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version. CVSS Base score: 9.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/136262](<https://exchange.xforce.ibmcloud.com/vulnerabilities/136262>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) **CVEID: **[CVE-2013-0248](<https://vulners.com/cve/CVE-2013-0248>) **DESCRIPTION: **The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack. CVSS Base score: 3.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/82618](<https://exchange.xforce.ibmcloud.com/vulnerabilities/82618>) for the current score. CVSS Vector: (AV:L/AC:M/Au:N/C:N/I:P/A:P) **CVEID: **[CVE-2016-1000031](<https://vulners.com/cve/CVE-2016-1000031>) **DESCRIPTION: **Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution CVSS Base score: 9.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/117957](<https://exchange.xforce.ibmcloud.com/vulnerabilities/117957>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) **CVEID: **[CVE-2014-0050](<https://vulners.com/cve/CVE-2014-0050>) **DESCRIPTION: **MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions. CVSS Base score: 5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/90987](<https://exchange.xforce.ibmcloud.com/vulnerabilities/90987>) for the current score. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) **CVEID: **[CVE-2018-20433](<https://vulners.com/cve/CVE-2018-20433>) **DESCRIPTION: **c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization. CVSS Base score: 5.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/154680](<https://exchange.xforce.ibmcloud.com/vulnerabilities/154680>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) **CVEID: **[CVE-2019-5427](<https://vulners.com/cve/CVE-2019-5427>) **DESCRIPTION: **c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration. CVSS Base score: 5.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/160025](<https://exchange.xforce.ibmcloud.com/vulnerabilities/160025>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2012-5055](<https://vulners.com/cve/CVE-2012-5055>) **DESCRIPTION: **DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests. CVSS Base score: 5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/80568](<https://exchange.xforce.ibmcloud.com/vulnerabilities/80568>) for the current score. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N) **CVEID: **[CVE-2016-3093](<https://vulners.com/cve/CVE-2016-3093>) **DESCRIPTION: **Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors. CVSS Base score: 5.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/113686](<https://exchange.xforce.ibmcloud.com/vulnerabilities/113686>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) **CVEID: **[CVE-2016-5725](<https://vulners.com/cve/CVE-2016-5725>) **DESCRIPTION: **Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command. CVSS Base score: 4.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/117122](<https://exchange.xforce.ibmcloud.com/vulnerabilities/117122>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) **CVEID: **[CVE-2018-10237](<https://vulners.com/cve/CVE-2018-10237>) **DESCRIPTION: **Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/142508](<https://exchange.xforce.ibmcloud.com/vulnerabilities/142508>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2012-5783](<https://vulners.com/cve/CVE-2012-5783>) **DESCRIPTION: **Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. CVSS Base score: 4.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/79984](<https://exchange.xforce.ibmcloud.com/vulnerabilities/79984>) for the current score. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) **CVEID: **[CVE-2019-5427](<https://vulners.com/cve/CVE-2019-5427>) **DESCRIPTION: **c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration. CVSS Base score: 5.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/160025](<https://exchange.xforce.ibmcloud.com/vulnerabilities/160025>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2012-2098](<https://vulners.com/cve/CVE-2012-2098>) **DESCRIPTION: **Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs. CVSS Base score: 5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/75857](<https://exchange.xforce.ibmcloud.com/vulnerabilities/75857>) for the current score. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) **CVEID: **[CVE-2014-3578](<https://vulners.com/cve/CVE-2014-3578>) **DESCRIPTION: **Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL. CVSS Base score: 5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/93774](<https://exchange.xforce.ibmcloud.com/vulnerabilities/93774>) for the current score. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N) **CVEID: **[CVE-2018-1272](<https://vulners.com/cve/CVE-2018-1272>) **DESCRIPTION: **Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles. CVSS Base score: 5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/141286](<https://exchange.xforce.ibmcloud.com/vulnerabilities/141286>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) **CVEID: **[CVE-2014-3603](<https://vulners.com/cve/CVE-2014-3603>) **DESCRIPTION: **The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. CVSS Base score: 6.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/164271](<https://exchange.xforce.ibmcloud.com/vulnerabilities/164271>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) **CVEID: **[CVE-2015-1796](<https://vulners.com/cve/CVE-2015-1796>) **DESCRIPTION: **The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor. CVSS Base score: 5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/105594](<https://exchange.xforce.ibmcloud.com/vulnerabilities/105594>) for the current score. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N) **CVEID: **[CVE-2017-5645](<https://vulners.com/cve/CVE-2017-5645>) **DESCRIPTION: **In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. CVSS Base score: 8.1 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/127479](<https://exchange.xforce.ibmcloud.com/vulnerabilities/127479>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) **CVEID: **[CVE-2017-7957](<https://vulners.com/cve/CVE-2017-7957>) **DESCRIPTION: **XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call. CVSS Base score: 5.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/125800](<https://exchange.xforce.ibmcloud.com/vulnerabilities/125800>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) **CVEID: **[CVE-2016-3674](<https://vulners.com/cve/CVE-2016-3674>) **DESCRIPTION: **Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document. CVSS Base score: 5.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/111806](<https://exchange.xforce.ibmcloud.com/vulnerabilities/111806>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) **CVEID: **[CVE-2013-7285](<https://vulners.com/cve/CVE-2013-7285>) **DESCRIPTION: **Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON. CVSS Base score: 6.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/90229](<https://exchange.xforce.ibmcloud.com/vulnerabilities/90229>) for the current score. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P) **CVEID: **[CVE-2009-2625](<https://vulners.com/cve/CVE-2009-2625>) **DESCRIPTION: **XMLScanner.java in Apache Xerces2 Java, asused in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework. CVSS Base score: 5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/53082](<https://exchange.xforce.ibmcloud.com/vulnerabilities/53082>) for the current score. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) **CVEID: **[CVE-2013-4002](<https://vulners.com/cve/CVE-2013-4002>) **DESCRIPTION: **XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause adenial of service via vectors related to XML attribute names. CVSS Base score: 7.1 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/85260](<https://exchange.xforce.ibmcloud.com/vulnerabilities/85260>) for the current score. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C) **CVEID: **[CVE-2012-0881](<https://vulners.com/cve/CVE-2012-0881>) **DESCRIPTION: **Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/134404](<https://exchange.xforce.ibmcloud.com/vulnerabilities/134404>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) **CVEID: **[CVE-2015-6420](<https://vulners.com/cve/CVE-2015-6420>) **DESCRIPTION: **Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. CVSS Base score: 9.8 CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) **CVEID: **[CVE-2017-15708](<https://vulners.com/cve/CVE-2017-15708>) **DESCRIPTION: **In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version. CVSS Base score: 9.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/136262](<https://exchange.xforce.ibmcloud.com/vulnerabilities/136262>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) **CVEID: **[CVE-2019-12384](<https://vulners.com/cve/CVE-2019-12384>) **DESCRIPTION: **FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible. CVSS Base score: 9.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/162849](<https://exchange.xforce.ibmcloud.com/vulnerabilities/162849>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) **CVEID: **[CVE-2019-12814](<https://vulners.com/cve/CVE-2019-12814>) **DESCRIPTION: **A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/162875](<https://exchange.xforce.ibmcloud.com/vulnerabilities/162875>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) ## Affected Products and Versions Affected Product(s) | Version(s) ---|--- StoredIQ | 7.6.0 ## Remediation/Fixes _Product_ | _VRMF_ | _APAR_ | _Remediation/First Fix_ ---|---|---|--- IBM StoredIQ | 7.6.0.0 - 7.6.0.19 | _N/A_ | Apply Fix Pack 7.6.0.20 that is available from Fix Central. ## Workarounds and Mitigations None ##


Affected Software


CPE Name Name Version
storediq 7.6.0

Related


debian
unix

[SECURITY] [DLA 945-1] mysql-connector-java security update

2017-05-16T22:52:19
debian
unix

[SECURITY] [DLA 945-1] mysql-connector-java security update

2017-05-16T22:52:19
debian
unix

[SECURITY] [DLA 1831-1] jackson-databind security update

2019-06-21T15:09:36
debian
unix

[SECURITY] [DLA 1831-1] jackson-databind security update

2019-06-21T15:09:36
debian
unix

[SECURITY] [DSA 3857-1] mysql-connector-java security update

2017-05-18T20:35:41
debian
unix

[SECURITY] [DLA 1621-1] c3p0 security update

2018-12-28T18:58:36
debian
unix

[SECURITY] [DLA 1621-1] c3p0 security update

2018-12-28T18:58:36
debian
unix

[SECURITY] [DLA 2184-1] jsch security update

2020-04-25T17:25:49
debian
unix

[SECURITY] [DLA 611-1] jsch security update

2016-09-05T18:07:45
debian
unix

[SECURITY] [DLA 930-1] libxstream-java security update

2017-05-01T08:57:58
debian
unix

[SECURITY] [DSA 3841-1] libxstream-java

2017-05-02T21:19:12
debian
unix

[SECURITY] [DLA 504-1] libxstream-java security update

2016-06-08T09:16:41
debian
unix

[SECURITY] [DLA 504-1] libxstream-java security update

2016-06-08T09:16:41
debian
unix

[SECURITY] [DSA 3575-1] libxstream-java security update

2016-05-12T20:06:14
osv
software

mysql-connector-java - security update

2017-05-16T00:00:00
osv
software

jackson-databind - security update

2019-06-21T00:00:00
osv
software

mysql-connector-java - security update

2017-05-18T00:00:00
osv
software

Exposure of Sensitive Information to an Unauthorized Actor in Spring Security

2022-05-17T05:17:30
osv
software

c3p0 - security update

2018-12-28T00:00:00
osv
software

XML External Entity Reference in mchange:c3p0

2019-01-07T19:14:34
osv
software

Improper Input Validation in Apache Axis2

2022-05-17T02:22:43
osv
software

Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch

2022-05-13T01:09:33
osv
software

jsch - security update

2016-09-05T00:00:00
osv
software

jsch - security update

2020-04-25T00:00:00
osv
software

Remote Code Execution in Apache Synapse

2020-11-04T18:23:25
osv
software

libxstream-java - security update

2017-05-01T00:00:00
osv
software

Denial of service in XStream

2020-06-30T22:48:24
osv
software

libxstream-java - security update

2017-05-02T00:00:00
osv
software

Denial of service in Apache Xerces2

2020-06-15T18:51:38
osv
software

libxstream-java - security update

2016-05-12T00:00:00
osv
software

XML External Entity Injection in XStream

2020-06-30T22:48:14
osv
software

libxstream-java - security update

2016-06-08T00:00:00
osv
software

Uncontrolled Resource Consumption in Apache Commons Compress

2022-05-13T01:07:05
osv
software

Improper Input Validation in Apache Struts

2022-05-17T03:42:18
osv
software

Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

2022-05-14T00:56:29
openvas
scanner

Debian LTS: Security Advisory for mysql-connector-java (DLA-945-1)

2018-01-25T00:00:00
openvas
scanner

Fedora Update for c3p0 FEDORA-2019-cb14e234fc

2019-05-29T00:00:00
openvas
scanner

Fedora Update for c3p0 FEDORA-2019-063672154a

2019-06-02T00:00:00
openvas
scanner

Debian LTS: Security Advisory for jackson-databind (DLA-1831-1)

2019-06-22T00:00:00
openvas
scanner

Debian Security Advisory DSA 3857-1 (mysql-connector-java - security update)

2017-05-18T00:00:00
openvas
scanner

Debian Security Advisory DSA 3857-1 (mysql-connector-java - security update)

2017-05-18T00:00:00
openvas
scanner

Debian LTS: Security Advisory for c3p0 (DLA-1621-1)

2019-01-03T00:00:00
openvas
scanner

Apache Axis2 Document Type Declaration Processing Security Vulnerability

2010-09-20T00:00:00
openvas
scanner

Debian LTS: Security Advisory for jsch (DLA-2184-1)

2020-04-26T00:00:00
openvas
scanner

Debian Security Advisory DSA 3841-1 (libxstream-java - security update)

2017-05-02T00:00:00
openvas
scanner

Debian Security Advisory DSA 3841-1 (libxstream-java - security update)

2017-05-02T00:00:00
openvas
scanner

Debian LTS: Security Advisory for libxstream-java (DLA-930-1)

2018-01-25T00:00:00
openvas
scanner

Fedora Update for xstream FEDORA-2016-175

2016-04-11T00:00:00
openvas
scanner

Debian Security Advisory DSA 3575-1 (libxstream-java - security update)

2016-05-12T00:00:00
openvas
scanner

Mageia Linux Local Check: mgasa-2016-0164

2016-05-09T00:00:00
openvas
scanner

Fedora Update for xstream FEDORA-2016-250042

2016-04-27T00:00:00
openvas
scanner

Debian Security Advisory DSA 3575-1 (libxstream-java - security update)

2016-05-12T00:00:00
openvas
scanner

Fedora Update for plexus-archiver FEDORA-2013-5548

2013-05-13T00:00:00
openvas
scanner

Fedora Update for plexus-archiver FEDORA-2013-5546

2013-05-13T00:00:00
openvas
scanner

Fedora Update for apache-commons-compress FEDORA-2012-8465

2012-06-04T00:00:00
openvas
scanner

Fedora Update for apache-commons-compress FEDORA-2012-8428

2012-08-30T00:00:00
openvas
scanner

Fedora Update for apache-commons-compress FEDORA-2012-8465

2012-06-04T00:00:00
openvas
scanner

Fedora Update for plexus-archiver FEDORA-2013-5546

2013-05-13T00:00:00
openvas
scanner

Fedora Update for plexus-archiver FEDORA-2013-5548

2013-05-13T00:00:00
openvas
scanner

Fedora Update for apache-commons-compress FEDORA-2012-8428

2012-08-30T00:00:00
nessus
scanner

Debian DLA-945-1 : mysql-connector-java security update

2017-05-17T00:00:00
nessus
scanner

openSUSE Security Update : mysql-connector-java (openSUSE-2018-248)

2018-03-13T00:00:00
nessus
scanner

Fedora 29 : c3p0 (2019-063672154a)

2019-05-29T00:00:00
nessus
scanner

Fedora 30 : c3p0 (2019-cb14e234fc)

2019-05-29T00:00:00
nessus
scanner

Debian DLA-1831-1 : jackson-databind security update

2019-06-24T00:00:00
nessus
scanner

Debian DSA-3857-1 : mysql-connector-java - security update

2017-05-19T00:00:00
nessus
scanner

JFrog < 7.10.1 Multiple Vulnerabilities

2020-12-16T00:00:00
nessus
scanner

GLSA-202107-39 : Apache Commons FileUpload: Multiple vulnerabilities

2022-01-24T00:00:00
nessus
scanner

Debian DLA-1621-1 : c3p0 security update

2018-12-31T00:00:00
nessus
scanner

Debian DLA-611-1 : jsch security update

2016-09-06T00:00:00
nessus
scanner

Debian DLA-2184-1 : jsch security update

2020-04-27T00:00:00
nessus
scanner

GLSA-202107-37 : Apache Commons Collections: Remote code execution

2022-01-24T00:00:00
nessus
scanner

Apache Synapse < 3.0.1 Remote Code Execution Vulnerability

2020-11-03T00:00:00
nessus
scanner

Debian DLA-930-1 : libxstream-java security update

2017-05-02T00:00:00
nessus
scanner

Debian DSA-3841-1 : libxstream-java - security update

2017-05-04T00:00:00
nessus
scanner

EulerOS 2.0 SP3 : xerces-j2 (EulerOS-SA-2020-2068)

2020-09-28T00:00:00
nessus
scanner

EulerOS 2.0 SP8 : xerces-j2 (EulerOS-SA-2020-1889)

2020-08-28T00:00:00
nessus
scanner

EulerOS 2.0 SP2 : xerces-j2 (EulerOS-SA-2020-2405)

2020-11-03T00:00:00
nessus
scanner

EulerOS 2.0 SP5 : xerces-j2 (EulerOS-SA-2020-2277)

2020-10-30T00:00:00
nessus
scanner

Fedora 22 : xstream-1.4.9-1.fc22 (2016-250042b8a6)

2016-04-27T00:00:00
nessus
scanner

Fedora 24 : xstream-1.4.9-1.fc24 (2016-175b56bb05)

2016-04-05T00:00:00
nessus
scanner

Fedora 23 : xstream-1.4.9-1.fc23 (2016-de909cc333)

2016-04-27T00:00:00
nessus
scanner

Debian DSA-3575-1 : libxstream-java - security update

2016-05-13T00:00:00
nessus
scanner

Debian DLA-504-1 : libxstream-java security update

2016-06-09T00:00:00
nessus
scanner

Fedora 18 : plexus-archiver-2.3-1.fc18 (2013-5548)

2013-05-11T00:00:00
nessus
scanner

Fedora 17 : plexus-archiver-2.3-1.fc17 (2013-5546)

2013-05-11T00:00:00
nessus
scanner

Fedora 19 : plexus-archiver-2.3-1.fc19 (2013-5530)

2013-05-11T00:00:00
nessus
scanner

Oracle Solaris Third-Party Patch Update : ant (algorithmic_complexity_vulnerability_in_apache)

2015-01-19T00:00:00
nessus
scanner

Fedora 16 : apache-commons-compress-1.4.1-1.fc16 (2012-8465)

2012-06-04T00:00:00
nessus
scanner

Fedora 17 : apache-commons-compress-1.4.1-1.fc17 (2012-8428)

2012-06-04T00:00:00
nessus
scanner

F5 Networks BIG-IP : Apache Struts 2 vulnerability (K23432135)

2016-06-28T00:00:00
mageia
unix

Updated mysql-connector-java packages fix security vulnerabilities

2017-10-24T05:50:58
mageia
unix

Updated c3p0 packages fix security vulnerabilities

2020-01-28T07:52:40
mageia
unix

Updated jsch packages fix security vulnerability

2016-09-21T20:38:22
mageia
unix

Updated xstream packages fix CVE-2016-3674

2016-05-05T16:26:44
mageia
unix

Updated plexus-archiver package fixes security vulnerability

2014-02-12T17:07:07
ibm
software

Security Bulletin: Apache Solr, shipped with IBM Operations Analytics - Log Analysis, susceptible to multiple vulnerabilities in Apache Xerces2

2021-04-16T07:16:00
ibm
software

Security Bulletin: CVE-2009-2625 CVE-2012-0881 CVE-2013-4002 CVE-2014-0107 Multiple Xml handling Issues in xerces and xalan

2020-08-04T18:49:55
ibm
software

Security Bulletin: Multiple denial of service vulnerabilities in Apache Xerces affect IBM InfoSphere Information Server

2022-10-18T20:24:46
ibm
software

Security Bulletin: IBM Sterling Global Mailbox is vulnerable to arbitrary code execution due to Apache Commons Collections [CVE-2015-6420, CVE-2017-15708]

2023-02-22T13:38:06
ibm
software

Security Bulletin: Apache Xerces2 Vulnerabilities Affect IBM Sterling B2B Integrator (CVE-2012-0881, CVE-2013-4002)

2021-10-05T20:51:14
ibm
software

Security Bulletin: ClassLoader manipulation with Apache Struts (CVE-2014-0114) and Denial Of Service vulnerability in Apache Commons FileUpload (CVE-2014-0050) affect IBM Business Process Manager (BPM) V8.5.5.0

2018-06-15T07:00:58
ibm
software

Security Bulletin: Atlas eDiscovery Process Management is affected by a vulnerable org.apache.xerces_2.9.0.v201101211617-4.8.0.jar

2023-05-08T08:35:39
ibm
software

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and IntegrationServer operands may be vulnerable to denial of service due to [CVE-2012-0881], [CVE-2013-4002] and [CVE-2022-23437]

2023-05-23T14:54:04
ibm
software

Security Bulletin: Multiple Vulnerabilities in Apache Commons Affect IBM Sterling B2B Integrator (CVE-2016-3092, CVE-2014-0050, CVE-2013-0248)

2020-02-05T00:53:36
ibm
software

Security Bulletin: IBM Jazz for Service Management (JazzSM) is affected with multiple vulnerabilities (CVE-2015-4852, CVE-2015-6420, CVE-2017-15708)

2020-10-20T11:33:26
ibm
software

Security Bulletin: Security Vulnerabilities have been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2012-5783, CVE-2018-1614, CVE-2014-0114, CVE-2015-0899)

2020-02-11T21:31:00
ibm
software

Security Bulletin: A vulnerability in Apache Commons Fileupload affects IBM Tivoli Business Service Manager (CVE-2013-2186, CVE-2013-0248, CVE-2016-3092, CVE-2014-0050, 220723)

2022-09-26T05:34:17
ibm
software

Security Bulletin: IBM System Networking Switch Center is affected by a Jsch vulnerability (CVE-2016-5725)

2019-01-31T02:25:02
ibm
software

Security Bulletin: Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE

2021-03-29T21:04:31
ibm
software

Security Bulletin: Multiple vulnerabilities in Apache Commons Collections affect IBM InfoSphere Information Server

2022-10-14T22:00:35
ibm
software

Security Bulletin: IBM Security Verify Governance is vulnerable to arbitrary code execution due to use of Apache Commons Collections (multiple vulnerabilities)

2022-11-22T16:37:00
ibm
software

Security Bulletin: IBM Tivoli Netcool Configuration Manager (ITNCM) is affected by a XStream vulnerability

2018-06-17T15:44:33
ibm
software

Security Bulletin: Open Source XStream as used in IBM QRadar SIEM is vulnerable to Denial of Service. (CVE-2017-7957)

2018-06-16T22:02:18
ibm
software

Security Bulletin: A vulnerability in XStream affects IBM InfoSphere Information Governance components

2018-06-16T13:48:38
ibm
software

Security Bulletin: XStream XML information discloure vulnerability affects IBM® Rational® Quality Manager (CVE-2016-3674)

2021-04-28T18:35:50
ibm
software

Security Bulletin: A vulnerability in Apache Ant affects IBM InfoSphere Information Server

2019-11-01T21:23:52
ibm
software

Security Bulletin:IBM TRIRIGA Application Platform discloses CVE-2016-3093

2022-08-30T16:40:55
githubexploit
exploit

Exploit for Improper Restriction of XML External Entity Reference in Mchange C3P0

2020-12-13T12:08:30
veracode
software

XML External Entity (XXE)

2018-12-26T01:56:50
veracode
software

Remote Code Execution (RCE)

2017-12-11T01:11:22
veracode
software

Denial Of Service (DoS)

2017-05-02T03:07:21
veracode
software

Denial Of Service (DoS)

2017-10-31T05:53:02
fedora
unix

[SECURITY] Fedora 29 Update: c3p0-0.9.5.4-1.fc29

2019-05-29T02:59:54
fedora
unix

[SECURITY] Fedora 30 Update: c3p0-0.9.5.4-1.fc30

2019-05-29T00:50:47
fedora
unix

[SECURITY] Fedora 22 Update: xstream-1.4.9-1.fc22

2016-04-26T21:24:48
fedora
unix

[SECURITY] Fedora 24 Update: xstream-1.4.9-1.fc24

2016-04-04T17:28:40
fedora
unix

[SECURITY] Fedora 23 Update: xstream-1.4.9-1.fc23

2016-04-26T20:58:33
fedora
unix

[SECURITY] Fedora 17 Update: plexus-archiver-2.3-1.fc17

2013-05-11T00:26:08
fedora
unix

[SECURITY] Fedora 16 Update: apache-commons-compress-1.4.1-1.fc16

2012-06-03T23:26:27
fedora
unix

[SECURITY] Fedora 17 Update: apache-commons-compress-1.4.1-1.fc17

2012-06-02T23:56:50
fedora
unix

[SECURITY] Fedora 18 Update: plexus-archiver-2.3-1.fc18

2013-05-11T00:27:50
fedora
unix

[SECURITY] Fedora 19 Update: plexus-archiver-2.3-1.fc19

2013-05-11T03:16:43
hackerone
bugbounty

Central Security Project: c3p0 may be exploited by a Billion Laughs Attack when loading XML configuration

2019-03-13T16:34:01
atlassian
software

Update atlassian-gadgets to 4.2.39 to fix CVE-2012-0881, CVE-2014-0114 and other vulnerabilities

2021-02-03T22:43:13
atlassian
software

Update atlassian-gadgets to 4.2.39 to fix CVE-2012-0881, CVE-2014-0114 and other vulnerabilities

2021-02-03T22:43:13
atlassian
software

Upgrade Xstream to address CVE-2016-3674

2019-07-08T23:32:08
atlassian
software

Upgrade Xstream to address CVE-2016-3674

2019-07-08T23:36:22
atlassian
software

Upgrade Xstream to address CVE-2016-3674

2019-07-08T23:36:22
atlassian
software

Upgrade Xstream to address CVE-2016-3674

2019-07-08T23:32:08
redhat
unix

(RHSA-2017:2889) Important: Red Hat JBoss BPM Suite 6.4.6 security update

2017-10-12T21:58:49
redhat
unix

(RHSA-2017:2888) Important: Red Hat JBoss BRMS 6.4.6 security update

2017-10-12T21:58:30
redhat
unix

(RHSA-2019:3297) Important: Red Hat Process Automation Manager 7.5.0 Security Update

2019-10-31T19:07:44
redhat
unix

(RHSA-2019:3292) Important: Red Hat Decision Manager 7.5.0 Security Update

2019-10-31T17:24:46
gentoo
unix

Apache Commons FileUpload: Multiple vulnerabilities

2021-07-17T00:00:00
gentoo
unix

Apache Commons Collections: Remote code execution

2021-07-16T00:00:00
ubuntucve
info

CVE-2012-5055

2012-12-05T00:00:00
ubuntucve
info

CVE-2018-20433

2018-12-24T00:00:00
ubuntucve
info

CVE-2010-1632

2010-06-22T00:00:00
ubuntucve
info

CVE-2016-5725

2017-01-19T00:00:00
ubuntucve
info

CVE-2017-7957

2017-04-29T00:00:00
ubuntucve
info

CVE-2012-0881

2017-10-30T00:00:00
ubuntucve
info

CVE-2016-3674

2016-05-17T00:00:00
ubuntucve
info

CVE-2012-2098

2012-06-29T00:00:00
ubuntucve
info

CVE-2016-3093

2016-06-07T00:00:00
ubuntucve
info

CVE-2014-3578

2015-02-19T00:00:00
ubuntucve
info

CVE-2013-7285

2019-05-15T00:00:00
github
software

Exposure of Sensitive Information to an Unauthorized Actor in Spring Security

2022-05-17T05:17:30
github
software

XML External Entity Reference in mchange:c3p0

2019-01-07T19:14:34
github
software

Improper Input Validation in Apache Axis2

2022-05-17T02:22:43
github
software

Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch

2022-05-13T01:09:33
github
software

Remote Code Execution in Apache Synapse

2020-11-04T18:23:25
github
software

Denial of service in XStream

2020-06-30T22:48:24
github
software

Denial of service in Apache Xerces2

2020-06-15T18:51:38
github
software

XML External Entity Injection in XStream

2020-06-30T22:48:14
github
software

Uncontrolled Resource Consumption in Apache Commons Compress

2022-05-13T01:07:05
github
software

Improper Input Validation in Apache Struts

2022-05-17T03:42:18
github
software

Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

2022-05-14T00:56:29
cve
NVD

CVE-2012-5055

2012-12-05T17:55:00
cve
NVD

CVE-2018-20433

2018-12-24T13:29:00
cve
NVD

CVE-2010-1632

2010-06-22T20:30:00
cve
NVD

CVE-2016-5725

2017-01-19T22:59:00
cve
NVD

CVE-2017-15708

2017-12-11T15:29:00
cve
NVD

CVE-2017-7957

2017-04-29T19:59:00
cve
NVD

CVE-2012-0881

2017-10-30T16:29:00
cve
NVD

CVE-2016-3674

2016-05-17T14:08:00
cve
NVD

CVE-2012-2098

2012-06-29T19:55:00
cve
NVD

CVE-2016-3093

2016-06-07T18:59:00
cve
NVD

CVE-2014-3578

2015-02-19T20:59:00
cve
NVD

CVE-2013-7285

2019-05-15T17:29:00
debiancve
info

CVE-2018-20433

2018-12-24T13:29:00
debiancve
info

CVE-2016-5725

2017-01-19T22:59:00
debiancve
info

CVE-2017-7957

2017-04-29T19:59:00
debiancve
info

CVE-2012-0881

2017-10-30T16:29:00
debiancve
info

CVE-2016-3674

2016-05-17T14:08:00
debiancve
info

CVE-2012-2098

2012-06-29T19:55:00
debiancve
info

CVE-2014-3578

2015-02-19T20:59:00
redhatcve
info

CVE-2018-20433

2019-01-09T14:20:42
redhatcve
info

CVE-2016-3093

2016-06-01T13:48:53
d2
exploit

DSquare Exploit Pack: D2SEC_AXIS

2010-06-22T20:30:00
dsquare
exploit

Apache Axis2 File Disclosure

2012-02-01T00:00:00
seebug
exploit

Apache Axis2文档类型声明处理多个安全漏洞

2010-06-23T00:00:00
seebug
exploit

Apache Synapse远程命令执行漏洞(CVE-2017-15708)

2017-12-12T00:00:00
seebug
exploit

Apache Commons Compress和Apache Ant拒绝服务漏洞

2012-05-25T00:00:00
exploitpack
exploit

JCraftJSch Java Secure Channel 0.1.53 - Recursive sftp-get Directory Traversal

2016-09-22T00:00:00
zdt
exploit

JCraft / JSch Java Secure Channel 0.1.53 - Recursive sftp-get Directory Traversal

2016-09-22T00:00:00
f5
software

SOL23432135 - Apache Struts 2 vulnerability CVE-2016-3093

2016-06-27T00:00:00
f5
software

Apache Struts 2 vulnerability CVE-2016-3093

2016-06-27T22:37:00
jvn
info

JVN#49154900: Spring Framework vulnerable to directory traversal

2014-06-13T00:00:00