ph-commons 缓冲区错误漏洞

ph-commons is a set of shared Java 11+ libraries used in many other projects by the individual developer Philip Helger. A security vulnerability exists in ph-commons ph-json 9.5.5 and earlier versions, which stems from a vulnerability that allows an attacker to cause a denial of service by using...

SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2023:2505-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2505-1 advisory. Updated to version 9.0.75: - CVE-2023-28709: Mended an incomplete fix for CVE-2023-24998 bsc1208513, bsc1211608...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a local user accessing sensitive information due to IBM MQ Managed File Transfer and Apache Commons Net (CVE-2021-37533, CVE-2022-42436, CVE-2022-43919)

Summary IBM App Connect Enterprise and IBM Integration Bus FTE nodes are vulnerable to an issue in IBM MQ Managed File Transfer where a local user can obtain sensitive information from diagnostic files and Apache Commons Net could allow a remote attack CVE-2021-37533, CVE-2022-42436,...

Huawei EulerOS: Security Advisory for tomcat (EulerOS-SA-2023-2177)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : bcel (EulerOS-SA-2023-2137)

According to the versions of the bcel package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds...

Huawei EulerOS: Security Advisory for bcel (EulerOS-SA-2023-2137)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics Installed IBM WebSphere Application Server traditional is vulnerable to a denial of service due to Apache Commons FileUpload

Summary The security issue described in CVE-2023-24998 has been identified in the WebSphere Application Server traditional included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

SUSE SLES15 / openSUSE 15 Security Update : apache-commons-fileupload (SUSE-SU-2023:2390-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2390-1 advisory. Updated to version 1.5: - CVE-2023-24998: Added a configurable maximum number of files to upload per request bsc1208513. Tenab...

Security Bulletin: There is a vulnerability in Apache Commons Net used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2021-37533)

Summary There is a vulnerability in Apache Commons Net used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2021-37533 DESCRIPTION: Apache Commons Net could allow a remote attacker to obtain sensitive information, caused by an issue with the FTP...

Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities

Summary There are multiple vulnerabilities in components of IBM i Modernization Engine for Lifecycle Integration as described in the Vulnerability Details section. VMware Tanzu Spring Security and Spring Framework could allow a remote attacker to bypass security restrictions. VMware Tanzu Spring...

SUSE: Security Advisory (SUSE-SU-2023:2390-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to a denial of service due to Apache Commons FileUpload (CVE-2023-24998)

Summary There is a vulnerability in the Apache Commons FileUpload library used by IBM Sterling Partner Engagement Manager. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of...

SUSE-SU-2023:2390-1 Security update for apache-commons-fileupload

This update for apache-commons-fileupload fixes the following issues: Updated to version 1.5: - CVE-2023-24998: Added a configurable maximum number of files to upload per request bsc1208513...

Amazon Linux 2 : apache-commons-io (ALAS-2023-2059)

The version of apache-commons-io installed on the remote host is prior to 2.4-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2059 advisory. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like...

Security Bulletin: Apache commons fileupload vulnerability affect embedded Case Forms in IBM Business Automation Workflow and IBM Case Manager - CVE-2023-24998

Summary Embedded Case Forms in IBM Business Automation Workflow and IBM Case Manager are affected by Apache commons fileupload vulnerability. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the...

Medium: apache-commons-io

Issue Overview: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus...

Security Bulletin: Apache Commons Text vulnerability affects Netcool Operations Insight [CVE-2022-42889]

Summary Apache Commons Text vulnerability affects Netcool Operations Insight. Apache Commons Text is used by multiple Netcool Operation Insight Services. The vulnerability has been addressed. CVE-2022-42889 Vulnerability Details CVEID:CVE-2022-42889 DESCRIPTION: OX AppSuite could allow a remote...

Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities

Summary IBM Cloud Transformation Advisor has addressed several security vulnerabilities including those in Go, OpenSSL and Node.js Vulnerability Details CVEID:CVE-2023-0361 DESCRIPTION: GnuTLS could allow a remote attacker to obtain sensitive information, caused by a timing side-channel flaw in t...

maven bug fix and enhancement update

An update is available for plexus-interpolation, httpcomponents-core, maven-wagon, maven, google-guice, jsoup, jansi, apache-commons-io, apache-commons-lang3, maven-shared-utils, plexus-utils, plexus-classworlds, jakarta-annotations, httpcomponents-client, apache-commons-codec, plexus-cipher,...

FileUpload: FileUpload DoS with excessive parts

A flaw was found in Apache Commons FileUpload, where it does not limit the number of parts being processed in a request. This issue may allow an attacker to use a malicious upload or series of uploads to trigger a denial of service. While Red Hat Satellite relies upon Apache Tomcat, it does not...