Jenkins CLI Deserialization of Untrusted Data vulnerability

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-.jar file and the "Groovy variant in ysoserial"...

ch.inftec.ju:ju-dbutil (>=4.1, <=4.5.1-11), ch.inftec.ju:ju-dbutil-test (4.1) +658 more potentially affected by CVE-2015-7501 via net.sourceforge.collections:collections-generic (4.01)

net.sourceforge.collections:collections-generic MAVEN version 4.01 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.collections:collections-generic and may be impacted: - ch.inftec.ju:ju-dbutil =4.1, =4.4-5, =4.4-4, =4.1, =4.1, =4.1, =4....

ch.marcus-schulte.maven:hivedoc-plugin (>=1.0.0, <=1.0.2), checkstyle:checkstyle (>=5.0-beta01, <=5.0) +170 more potentially affected by CVE-2015-7501 via commons-collections:commons-collections (2.0)

commons-collections:commons-collections MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on commons-collections:commons-collections and may be impacted: - ch.marcus-schulte.maven:hivedoc-plugin =1.0.0, =5.0-beta01, =1.0.0, =1.10.3, =2.8.0...

org.opendaylight.bier:bier-karaf (0.3.4), org.opendaylight.bier:features-bier (0.3.4) +10 more potentially affected by CVE-2015-7501 via org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic (4.01_1)

org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic MAVEN version 4.011 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic and may be impacted: -...

GHSA-FJQ5-5J5F-MVXH Deserialization of Untrusted Data in Apache commons collections

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...

acegisecurity:acegi-security (>=0.7.0, <=0.9.0), acegisecurity:acegi-security-cas (>=0.7.0, <=0.9.0) +24662 more potentially affected by CVE-2015-7501 via commons-collections:commons-collections (>=3.0, <=3.2.1)

commons-collections:commons-collections MAVEN version =3.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.0.1, =0.6.0, =0.12.0 - ai.grakn.kgms:client 1.4.3 - ai.grakn.kgms:console 1.4.3 and more Source cves: CVE-2015-7501 Source advisory: GHSA-FJQ5-5J5F-MVXH...

Deserialization of Untrusted Data in Apache commons collections

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...

net.osgiliath.framework:net.osgiliath.features.karaf-features-full (>=0.0.1, <=0.0.3), net.osgiliath.framework:net.osgiliath.features.karaf-features-jpa (>=0.0.1, <=0.0.3) +48 more potentially affected by CVE-2015-7501 via org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections (>=3.2.1_1, <=3.2.1_3)

org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections MAVEN version =3.2.11, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.2.0, =1.0.2, =1.0.8 - org.frie...

ch.inftec.ju:ju-dbutil (>=4.1, <=4.5.1-11), ch.inftec.ju:ju-dbutil-test (4.1) +658 more potentially affected by CVE-2015-7501 via net.sourceforge.collections:collections-generic (4.01)

net.sourceforge.collections:collections-generic MAVEN version 4.01 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.collections:collections-generic and may be impacted: - ch.inftec.ju:ju-dbutil =4.1, =4.4-5, =4.4-4, =4.1, =4.1, =4.1, =4....

net.osgiliath.framework:net.osgiliath.features.karaf-features-full (>=0.0.1, <=0.0.3), net.osgiliath.framework:net.osgiliath.features.karaf-features-jpa (>=0.0.1, <=0.0.3) +48 more potentially affected by CVE-2015-7501 via org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections (>=3.2.1_1, <=3.2.1_3)

org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections MAVEN version =3.2.11, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.2.0, =1.0.2, =1.0.8 - org.frie...

br.com.caelum.stella:hibernate-persistence-example (>=1.0, <=1.2), br.com.caelum.stella:vraptor-validator-example (>=1.0, <=1.2) +284 more potentially affected by CVE-2015-7501 via commons-collections:commons-collections (2.1.1)

commons-collections:commons-collections MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on commons-collections:commons-collections and may be impacted: - br.com.caelum.stella:hibernate-persistence-example =1.0, =1.0, =1.0.0, =1.0-beta,...

acegisecurity:acegi-security (>=0.7.0, <=0.9.0), acegisecurity:acegi-security-cas (>=0.7.0, <=0.9.0) +24662 more potentially affected by CVE-2015-7501 via commons-collections:commons-collections (>=3.0, <=3.2.1)

commons-collections:commons-collections MAVEN version =3.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.0.1, =0.6.0, =0.12.0 - ai.grakn.kgms:client 1.4.3 - ai.grakn.kgms:console 1.4.3 and more Source cves: CVE-2015-7501 Source advisory: OSV:GHSA-FJQ5-5J5F-MVXH...

activemq:activemq (1.1), activemq:activemq-core (3.2) +583 more potentially affected by CVE-2015-7501 via commons-collections:commons-collections (2.1)

commons-collections:commons-collections MAVEN version 2.1 is affected by a known vulnerability. The following packages have a transitive dependency on commons-collections:commons-collections and may be impacted: - activemq:activemq 1.1 - activemq:activemq-core 3.2 - activemq:activemq-gbean 3.2 -...

Moderate: Red Hat Security Advisory: Red Hat Software Collections security update

An update for rh-python38-python, rh-python38-python-lxml, and rh-python38-python-pip is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

RHEL 7 : Red Hat Software Collections (RHSA-2022:1664)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:1664 advisory. lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API. Security Fixes: python-lxml: HT...

Fedora: Security Advisory for golang-github-theupdateframework-notary (FEDORA-2022-5cbd6de569)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: golang-github-theupdateframework-notary-0.7.0-4.fc34

The Notary project comprises a server and a client for running and interacting with trusted collections. See the service architecture documentation for more information. Notary aims to make the internet more secure by making it easy for people to publish and verify content. We often rely on TLS t...

xstream: Injecting highly recursive collections or maps can cause a DoS

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulatin...

Adobe Acs-aem-commons cross-site scripting vulnerability

Adobe Acs-aem-commons is a Java-based codebase of AEM/CQ code collections generated from AEM by Adobe U.S. Adobe Acs-aem-commons 5.1.x and earlier versions contain a cross-site scripting vulnerability that could be exploited by an attacker to inject malicious JavaScript content into vulnerable fo...

CVE-2021-3681

A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the buildignore list in "galaxy.yml" include files in the .tar.gz file. This contains sensitive info, such as the user's Ansible Galaxy A...