Apache Commons Text 1.9 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Commons Text RCE', 'Description' = %q This exploit takes advantage of the StringSubstitutor interpolator class, which is included in the...

Oracle JDeveloper Multiple Vulnerabilities (January 2024 CPU)

The version of Oracle JDeveloper installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory. - Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware component: Oracle JDevelop...

Oracle Primavera Unifier (January 2024 CPU)

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory. - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Platform Google Guava. Supported versions that...

Oracle Primavera P6 Enterprise Project Portfolio Management (January 2024 CPU)

The version of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by vulnerabilities as referenced in the January 2024 CPU advisory. - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineeri...

Oracle Essbase Multiple Vulnerabilities (January 2024 CPU)

The version of Oracle Essbase installed on the remote host is missing a security patch from the January 2024 Critical Patch Update CPU. It is, therefore, affected by: - Vulnerability in Oracle Essbase component: Essbase Web Platform OpenSSL. Easily exploitable vulnerability allows unauthenticated...

Oracle WebCenter Portal Multiple Vulnerabilities (January 2024 CPU)

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the January 2024 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities: - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component:...

commons-net:OS400FTPEntryParserFuzzer: Security exception in java.base/java.util.regex.Pattern$BmpCharPropertyGreedy.match

Detailed Report: https://oss-fuzz.com/testcase?key=5646572389990400 Project: commons-net Fuzzing Engine: libFuzzer Fuzz Target: OS400FTPEntryParserFuzzer Job Type: libfuzzerasancommons-net Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

commons-validator:UrlValidator2Fuzzer: Security exception in java.base/java.util.regex.Pattern$Loop.match

Detailed Report: https://oss-fuzz.com/testcase?key=4599802356629504 Project: commons-validator Fuzzing Engine: libFuzzer Fuzz Target: UrlValidator2Fuzzer Job Type: libfuzzerasancommons-validator Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Security Bulletin: IBM Automation Decision Services December 2023 - Multiple CVEs addressed

Summary IBM Automation Decision Services is vulnerable to denial of service attacks in third party and open source used in the product for various functions. See full list below. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2023-32681 DESCRIPTION: python-requests could...

Security Bulletin: Security vulnerability in apache commons-codec may affect IBM Business Automation Workflow Case and Case History event emitters

Summary IBM Business Automation Workflow is vulnerable to an information leagage vulnerability. Vulnerability Details IBM X-Force ID: 177835 DESCRIPTION: Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the improper validation of input. An attacker cou...

Security Bulletin: Multiple Security Vulnerabilities were identified in IBM WebSphere Application Server Liberty shipped with IBM Security Verify Access (CVE-2023-24988, CVE-2023-44487, CVE-2023-46158)

Summary Security Vulnerability fixes in IBM WebSphere Application Server Liberty have been shipped with IBM Security Verify Access 10.0.7.0 Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the...

Amazon Linux 2 : xmlgraphics-commons (ALAS-2024-2411)

The version of xmlgraphics-commons installed on the remote host is prior to 1.5-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2411 advisory. Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input...

Medium: xmlgraphics-commons

Issue Overview: Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET...

XWiki vulnerable to Denial of Service attack through attachments

Impact A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. Patches This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1...

Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Governance - Identity Manager software component

Summary Multiple security vulnerabilities have been addressed in IBM Security Verify Governance - Identity Manager software component. Vulnerability Details CVEID:CVE-2023-2976 DESCRIPTION: Google Guava could allow a local authenticated attacker to obtain sensitive information, caused by a flaw...

org.infinispan.server:infinispan-server-commons (9.2.0.alpha1), org.infinispan.server:infinispan-server-event-logger (9.2.0.alpha1) +61 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (9.2.0.alpha1)

org.infinispan:infinispan-commons MAVEN version 9.2.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - org.infinispan.server:infinispan-server-commons 9.2.0.alpha1 -...

org.infinispan.server:infinispan-server-commons (9.0.1.final), org.infinispan.server:infinispan-server-event-logger (9.0.1.final) +59 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (9.0.1.final)

org.infinispan:infinispan-commons MAVEN version 9.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - org.infinispan.server:infinispan-server-commons 9.0.1.final -...

io.github.jeff-tian:keycloak-services-social-dingding (0.0.4), org.infinispan:infinispan-anchored-keys (>=15.0.0.dev01, <=15.0.0.dev06) +66 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (>=15.0.0.dev01, <=15.0.0.dev06)

org.infinispan:infinispan-commons MAVEN version =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev04, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev06 and more...

org.hibernate:hibernate-infinispan (>=5.0.0.beta1, <=5.0.0.beta2), org.infinispan.server:infinispan-server-testsuite (7.1.0.final) +32 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (7.1.0.final)

org.infinispan:infinispan-commons MAVEN version 7.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - org.hibernate:hibernate-infinispan =5.0.0.beta1, =5.0.0.beta2 -...

com.geeoz.atom:atom-api_2.11 (0.3.1), com.geeoz.atom:atom-audit_2.11 (0.3.1) +72 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (7.2.3.final)

org.infinispan:infinispan-commons MAVEN version 7.2.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - com.geeoz.atom:atom-api2.11 0.3.1 - com.geeoz.atom:atom-audit2.11 0.3.1 -...