Sandbox Protection Bypass

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause t...

XML External Entity (XXE)

java is vulnerable to XML External Entity XXE. The vulnerability exists through Beans...

Information Disclosure

openjdk is vulnerable to information disclosure. An unspecified vulnerability allows remote attackers to affect confidentiality via vectors related to BEANS...

Privilege Escalation

openjdk is vulnerable to privilege escalation. An unspecified vulnerability allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans...

Improper Access Control

Oracle Java SE is vulnerable to improper access control. Remote unauthenticated attackers could bypass Java sandbox restrictions via the vulnerable component Beans...

Oracle WebLogic Server Component Access Control Error Vulnerability (CNVD-2019-27112)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. WebLogic Server is one of the application server components for cloud and traditional...

Arbitrary Code Execution

GraniteDS is vulnerable to arbitrary code execution. It fails to prevent instantiation of untrusted object via public parameter-less constructor and calling arbitrary Java Beans setter methods. Thereby allowing an attacker to send malicious Java objects with pre-set properties, leading to arbitra...

Friday Squid Blogging: Squid with Chorizo, Tomato, and Beans

Nice recipe. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

CVE-2018-19531

HTTL aka Hyper-Text Template Language through 1.0.11 allows remote command execution because the decodeXml function uses java.beans.XMLEncoder unsafely when configured without an xml.codec= setting...

HTTL Remote Command Execution Vulnerability

HTTL also known as Hyper-Text Template Language is an open source Java template engine , it is mainly used for dynamic HTML page output . HTTL 1.0.11 and earlier versions of a security vulnerability , the vulnerability stems from the failure to configure the xml.codec , the program defaults to us...

org.springframework:spring-aop (2.0-m4), org.springframework:spring-beans (2.0-m4) +7 more potentially affected by CVE-2016-5007 via org.springframework:spring-core (2.0-m4)

org.springframework:spring-core MAVEN version 2.0-m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 2.0-m4 - org.springframework:spring-beans 2.0-m4 -...

org.springframework:spring-aop (1.2.2), org.springframework:spring-beans (1.2.2) +10 more potentially affected by CVE-2016-5007 via org.springframework:spring-core (1.2.2)

org.springframework:spring-core MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.2 - org.springframework:spring-beans 1.2.2 -...

org.springframework:spring-aop (1.2.4), org.springframework:spring-beans (1.2.4) +10 more potentially affected by CVE-2016-5007 via org.springframework:spring-core (1.2.4)

org.springframework:spring-core MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.4 - org.springframework:spring-beans 1.2.4 -...

org.springframework:spring-aop (1.2.3), org.springframework:spring-beans (1.2.3) +10 more potentially affected by CVE-2016-5007 via org.springframework:spring-core (1.2.3)

org.springframework:spring-core MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.3 - org.springframework:spring-beans 1.2.3 -...

org.jasig.service:person-directory (1.0.1), org.jasig:person-directory (1.0.0) +26 more potentially affected by CVE-2016-5007 via org.springframework:spring-core (2.0.3)

org.springframework:spring-core MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.jasig.service:person-directory 1.0.1 - org.jasig:person-directory 1.0.0 -...

org.acegisecurity:acegi-security (>=1.0.0-rc2, <=1.0.0), org.acegisecurity:acegi-security-adapters (1.0.0) +20 more potentially affected by CVE-2016-5007 via org.springframework:spring-core (2.0-m2)

org.springframework:spring-core MAVEN version 2.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.acegisecurity:acegi-security =1.0.0-rc2, =1.0.0 - org.acegisecurity:acegi-security-adapters...

org.springframework:spring-aop (2.0-m4), org.springframework:spring-beans (2.0-m4) +7 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (2.0-m4)

org.springframework:spring-core MAVEN version 2.0-m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 2.0-m4 - org.springframework:spring-beans 2.0-m4 -...

org.springframework:spring-aop (1.2.3), org.springframework:spring-beans (1.2.3) +10 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (1.2.3)

org.springframework:spring-core MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.3 - org.springframework:spring-beans 1.2.3 -...

org.acegisecurity:acegi-security (>=1.0.0-rc2, <=1.0.0), org.acegisecurity:acegi-security-adapters (1.0.0) +20 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (2.0-m2)

org.springframework:spring-core MAVEN version 2.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.acegisecurity:acegi-security =1.0.0-rc2, =1.0.0 - org.acegisecurity:acegi-security-adapters...

org.springframework:spring-aop (1.2.2), org.springframework:spring-beans (1.2.2) +10 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (1.2.2)

org.springframework:spring-core MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.2 - org.springframework:spring-beans 1.2.2 -...