CVE-2018-1273 Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions,

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded.

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "$prefix:name", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the...

OSV-2023-719 Security exception in org.apache.commons.jxpath.ri.compiler.CoreFunction.toString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61597 Crash type: Security exception Crash state: org.apache.commons.jxpath.ri.compiler.CoreFunction.toString java.base/java.lang.String.valueOf java.base/java.lang.StringBuilder.append...

Security Bulletin: IBM Match 360 is vulnerable to a denial of service due to Apache Commons FileUpload in IBM WebSphere Application Server Liberty (CVE-2023-24998)

Summary IBM Match 360 is vulnerable due to vulnerability in the Apache Commons FileUpload library used by IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0 or servlet-6.0 feature enabled. This has been addressed in the remediation section...

Security Bulletin: IBM Match 360 is vulnerable to a denial of service due to Apache Commons FileUpload in IBM WebSphere Application Server Liberty (CVE-2023-24998)

Summary IBM Match 360 is vulnerable due to vulnerability in the Apache Commons FileUpload library used by IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0 or servlet-6.0 feature enabled. This has been addressed in the remediation section...

SAP BusinessObjects Business Intelligence Platform DoS (3312047)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is using a vulnerable version of commons-fileupload which is vulnerable to Denial of Service due to CVE-2023-24998. Apache Commons FileUpload before 1.5 does not limit the number of request part...

OSV-2023-662 Security exception in org.apache.commons.io.IOUtils.byteArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61254 Crash type: Security exception Crash state: org.apache.commons.io.IOUtils.byteArray org.apache.commons.io.output.AbstractByteArrayOutputStream.needNewBuffer org.apache.commons.io.output.UnsynchronizedByteArrayOutputStrea...

Creative Commons Attribution 3.0 SQL Injection

==================================================================================================================================== | Title : Creative Commons Attribution v3.0 Sql Injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro | | Vendor :...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities (CVE-2023-24998 , CVE-2022-31129)

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

Security Bulletin: Vulnerability in Rational Change 5.3.2 Fix Pack 05 and earlier versions.

Summary Vulnerability in the Apache Commons FileUpload before 1.5 and earlier component shipped with Rational Change may affect the security of the product. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused b...

Security Bulletin: Vulnerability in commons-fileupload affects IBM Cloud Pak for Data System 1.0(CPDS 1.0) [CVE-2023-24998]

Summary The commons-fileupload package is used by IBM Cloud Pak for Data System 1.0 . IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2023-24998. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of...

CentOS: Security Advisory for bcel (CESA-2022:8958)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Jackrabbit Code Execution Vulnerability

Apache Jackrabbit is a content repository from Apache USA. A code execution vulnerability exists in Apache Jackrabbit Webapp/Standalone, which stems from the component commons-beanutils failing to properly filter special elements of constructed snippets. An attacker could exploit the vulnerabilit...

Security Bulletin: IBM TRIRIGA Application Platform is vulneraible to multiple vunerabilities [CVE-2016-0003], [CVE-2016-1000031] and [CVE-2016-0248]

Summary IBM TRIRIGA Application Platform updated the apache commons open source to latest version to fix the fulnerabilities in CVE-2016-0003, CVE-2016-1000031 and CVE-2016-0248. Vulnerability Details CVEID:CVE-2016-0003 DESCRIPTION: Microsoft Edge could allow a remote attacker to execute arbitra...

CentOS 7 : bcel (RHSA-2022:8958)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8958 advisory. - Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issu...

Remote Code Execution (RCE)

org.apache.jackrabbit:jackrabbit-standalone, jackrabbit-standalone-components and jackrabbit-webapp are vulnerable to Remote Code Execution RCE. Use of the component commons-beanutils, which contains a class that can be used for remote code execution over RMI, allows an attacker to upload and...

Oracle Primavera Unifier (Jul 2023 CPU)

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory. - Security-in-Depth issue in the Primavera Unifier product of Oracle Construction and Engineering component: User Interface JSZip. This vulnerabilit...

Remote code execution in Apache Jackrabbit

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...

GHSA-Q8CM-3V62-JJ79 Remote code execution in Apache Jackrabbit

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...

DEBIAN-CVE-2023-37895

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...