Medium: apache-commons-compress

Issue Overview: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package...

Medium: apache-commons-compress

Issue Overview: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package...

MAL-2025-1486 Malicious code in jetpack-e2e-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe798df756e79d2deb6db29c4675b6e0255d8d3607198c924e2ecb4a485b671f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jetpack-e2e-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe798df756e79d2deb6db29c4675b6e0255d8d3607198c924e2ecb4a485b671f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ROS-20250219-07

The vulnerability in the Apache Commons IO library is due to the fact that the application does not properly control the internal resource consumption when processing unreliable input data passed to the class org.apache.commons.io.input.XmlStreamReader. Exploitation of the vulnerability could all...

Oracle WebCenter Portal (January 2025 CPU)

The 12.2.1.4.0 versions of WebCenter Portal installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory. - jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts..configure. This vulnerability...

apache-commons-jxpath:JXPathFuzzer: Security exception in org.apache.commons.jxpath.ri.compiler.CoreOperationRelationalExpression.computeV

Detailed Report: https://oss-fuzz.com/testcase?key=4797711413215232 Project: apache-commons-jxpath Fuzzing Engine: libFuzzer Fuzz Target: JXPathFuzzer Job Type: libfuzzerasanapache-commons-jxpath Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

XWiki Platform Code Execution

The vulnerability in the library collection of XWiki Commons, a platform for creating collaborative web applications, is related to improper escaping of the symbol. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Apache Commons Vulnerabilities (CVE-2024-25710 and CVE-2024-26308)

CVE-2024-25710 Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue. CVE-2024-26308 Allocation of Resources Withou...

Azure Linux 3.0 Security Update: apache-commons-io (CVE-2024-47554)

The version of apache-commons-io installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-47554 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The...

Security Bulletin: Denial of Service vulnerability in Apache Commons IO affects IBM Business Automation Workflow - CVE-2024-47554

Summary IBM Business Automation Workflow packages a vulnerable version of Apache Commons IO. Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Apache Commons IO is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw in the...

Security Bulletin: Due to the use of Apache Commons IO, IBM WebSphere eXtreme Scale Liberty Deployment is vulnerable to an Uncontrolled Resource Consumption vulnerability

Summary YAJSW service is used for registering XSLD services with operating system. commons-io-2.11.0.jar bundled in YAJSW is vulnerable to CVE-2024-47554. This is fixed in yajsw-stable-13.13. Applying ifix PH65060 will upgrade YAJSW to 13.13 version. Vulnerability Details CVEID:CVE-2024-47554...

CVE-2022-23463

Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as...

Security Bulletin: Vulnerability in Apache Commons IO affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary Potential vulnerability in Apache Commons IO has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Uncontrolled Resour...

Security Bulletin: Vulnerability in Apache Commons IO affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary Potential vulnerability in Apache Commons IO has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Uncontrolled Resour...

Security Bulletin: Vulnerability in Apache Commons IO affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary A potential vulnerability in Apache Commons IO has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Apache Commons IO i...

Security Bulletin: Multiple vulnerabilities in IBM Db2 may affect IBM Storage Protect Server.

Summary IBM Storage Protect Server, which uses IBM Db2, may be affected by multiple vulnerabilities that could result in denial of service or the loss of confidentiality, integrity, or availability. These vulnerabilities include CVE-2023-45853, CVE-2023-29267, CVE-2024-25710, CVE-2024-26308,...

com.facebook.presto:presto-cassandra (>=0.146, <=0.166), com.stratio.cassandra:cassandra-lucene-index-plugin (2.1.6.2) +5 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.1.6)

org.apache.cassandra:cassandra-all MAVEN version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.facebook.presto:presto-cassandra =0.146, =0.1.0.final, =0.1.0.final, =0.4.0.final,...

Security Bulletin: Vulnerability with Eclipse Jetty, e2fsprogs, dnsjava , Apache Commons IO, Apache HTTP Server and Java SE affect IBM Cloud Object Storage Systems (Dec 2024)

Summary Vulnerability with Eclipse Jetty CVE-2024-9823, CVE-2024-6763, CVE-2024-8184, e2fsprogs CVE-2022-1304 dnsjava CVE-2024-25638, Apache Commons IO. CVE-2024-47554 , Apache HTTP ServerCVE-2024-40725 and Java SE CVE-2024-21217,CVE-2024-21235, CVE-2024-21210. This vulnerability has been address...

org.infinispan.server:infinispan-server-cli (8.1.0.alpha1), org.infinispan.server:infinispan-server-commons (8.1.0.alpha1) +45 more potentially affected by CVE-2025-23367 via org.wildfly.core:wildfly-server (2.0.0.cr1)

org.wildfly.core:wildfly-server MAVEN version 2.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.core:wildfly-server and may be impacted: - org.infinispan.server:infinispan-server-cli 8.1.0.alpha1 -...