Spring Cloud Azure 5.0 is now Generally Available

We're very pleased to announce that Spring Cloud Azure 5.0 is now generally available. This major release includes the following features, improvements, and documentation updates: Compatible with Spring Boot 3 and Spring Cloud 2022.0.0 Supports Passwordless Connections Updated Azure for Spring...

Apple addresses macOS Dirty Cow, Achilles, and other flaws

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Apple addressed multiple vulnerabilities in macOS Monterey. These vulnerabilities affect different functionalities such as Bluetooth, BOM, DriverKit, File System, IOHIDFamily, Kernel, and...

About the security content of macOS Monterey 12.6.2

About the security content of macOS Monterey 12.6.2 This document describes the security content of macOS Monterey 12.6.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

Spring Session 3.0.0-RC1

Spring Session 3.1.0-RC1 has been released. The biggest news from this release is that Spring Session Geode was removed which means all of the Spring Modules now belong to the same lifecycle. This means that the Spring Session BOM no longer uses CalVer and instead uses the same version as the...

CVE-2022-31684: Reactor Netty HTTP Server may log request headers

The Reactor Netty 1.0.24 release on October 11 included fix for CVE-2022-31684 affecting Reactor Netty HTTP Server. Users are encouraged to update as soon as possible. Reactor Netty is used internally in many frameworks including Spring WebFlux and its WebClient. If you have a Spring Boot...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialize function in the JSONSerializer class. An attacker can execute arbitrary code by sending a crafted JSON payload to the affected system. Details Serialization is a process of convertin...

SUSE SLED15: jackson-annotations / jackson-annotations-javadoc / jackson-bom / etc (SUSE-SU-2022:1678-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1678-1 advisory. Security issues fixed: - CVE-2020-36518: Fixed a Java stack overflow exception and denial of...

SUSE: Security Advisory (SUSE-SU-2022:1678-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:1678-1 Security update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core

This update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core fixes the following issues: Security issues fixed: - CVE-2020-36518: Fixed a Java stack overflow exception and denial of service via a large depth of nested objects in jackson-databind...

0x.plugin.bom:zero-x-plugin-bom (>=0.0.10 <=1.1.0), RPD:bmc-rpd (=1.1) +38106 more potentially affected by CVE-2012-2098 via org.apache.commons:commons-compress (>=1.0 <=1.4)

org.apache.commons:commons-compress MAVEN version =1.0, =0.0.10, =0.0.4, =0.1.0-alpha.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.3.5, =1.2.8 and more Source cves: CVE-2012-2098 Source advisory: OSV:GHSA-6FXM-66HQ-FC96...

Exploit for Code Injection in Vmware Spring_Framework

This is a PoC exploit for CVE-2022-22965, a remote code executio...

CVE-2022-24774

CycloneDX BOM Repository Server is a bill of materials BOM repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability ...

Input validation

CycloneDX BOM Repository Server is a bill of materials BOM repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability ...

CVE-2022-24774

CVE-2022-24774 affects CycloneDX BOM Repository Server prior to version 2.0.1, due to improper input validation that enables path traversal. An attacker could potentially create arbitrary directories or cause a denial of service by deleting directories. The issue is fixed in version 2.0.1. Under ...

CVE-2022-24774 Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server

CycloneDX BOM Repository Server is a bill of materials BOM repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability ...

CVE-2022-24774 Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server

CycloneDX BOM Repository Server is a bill of materials BOM repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability ...

CycloneDX BOM Repository Server 路径遍历漏洞

CycloneDX BOM Repository Server is a BOM repository server. It is used to distribute CycloneDX BOMs. A path traversal vulnerability exists in CycloneDX BOM Repository Server versions prior to 2.0.1, which stems from incorrect input validation leading to path traversal issues. An attacker can use...

About the security content of macOS Big Sur 11.6.5

About the security content of macOS Big Sur 11.6.5 This document describes the security content of macOS Big Sur 11.6.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

biz.eyebeam.mssc:mssc-public-bom (>=1.0.1 <=1.0.5), br.com.faroltech:mssc-brewery-bom (>=1.0.3 <=1.0.5) +405 more potentially affected by CVE-2022-23913 via org.apache.activemq:artemis-core-client (>=1.0.0 <=2.19.0)

org.apache.activemq:artemis-core-client MAVEN version =1.0.0, =1.0.1, =1.0.3, =5.0.9, =1.0.3, =1.6, =1.1, =1.0.3, =1.0.0, =1.0.12, =1.0.0, =1.0.0, =2019.9.14, =2019.9.14, =2021.11.24 and more Source cves: CVE-2022-23913 Source advisory: OSV:GHSA-PR38-QPXM-G88X...

0x.plugin.bom:zero-x-plugin-bom (>=0.0.10 <=1.1.0), RPD:bmc-rpd (=1.1) +17734 more potentially affected by CVE-2021-35517 via org.apache.commons:commons-compress (>=1.0 <=1.20)

org.apache.commons:commons-compress MAVEN version =1.0, =0.0.10, =0.0.4, =1.0.6, =1.0.6, =0.0.25, =0.0.25, =0.6.0, =0.5.0, =0.9.0, =0.5.0, =0.6.0, =0.11.0, =0.12.0 and more Source cves: CVE-2021-35517 Source advisory: OSV:GHSA-XQFJ-VM6H-2X34...