io.github.jeff-tian:keycloak-services-social-dingding (0.0.4), org.infinispan:infinispan-anchored-keys (>=15.0.0.dev01, <=15.0.0.dev06) +66 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (>=15.0.0.dev01, <=15.0.0.dev06)

org.infinispan:infinispan-commons MAVEN version =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev04, =15.0.0.dev01, =15.0.0.dev01, =15.0.0.dev06 and more...

at.chrl:chrl-orm (>=1.0.0, <=1.1.0), at.chrl:chrl-orm-spring-integration (1.1.0) +949 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (>=5.1.0.beta4, <=14.0.24.final)

org.infinispan:infinispan-commons MAVEN version =5.1.0.beta4, =1.0.0, =6.1.0, =6.2.1, =6.1.0, =6.1.0, =0.8.1, =0.8.1, =1.3.0, =0.8.1, =0.8.1, =1.3.0, =1.3.2 - cn.vertxup:aeon-ambient 0.9.0 - cn.vertxup:aeon-aurora 0.9.0 - cn.vertxup:aeon-code 0.9.0 and more Source cves: CVE-2023-5384 Source...

Apache Commons IO Vulnerability (CVE-2021-29425)

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path...

apache-commons-lang:SerializationUtilsFuzzer: Security exception in java.base/java.lang.reflect.Array.newArray

Detailed Report: https://oss-fuzz.com/testcase?key=5270591447629824 Project: apache-commons-lang Fuzzing Engine: libFuzzer Fuzz Target: SerializationUtilsFuzzer Job Type: libfuzzerasanapache-commons-lang Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Security Bulletin: Apache Commons Compress component is vulnerable to CVE-2023-42503 is used by IBM Maximo Application Suite

Summary IBM Maximo Application Suite uses Apache Commons Compress package which is vulnerable to CVE-2023-42503. Vulnerability Details CVEID:CVE-2023-42503 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by improper input validation. By persuading a victim to ope...

Security Bulletin: IBM Storage Insights is vulnerable to weaknesses related to Apache Commons Compress

Summary Vulnerability in Apache Commons Compress may affect IBM Storage Insights. Vulnerability Details CVEID:CVE-2023-42503 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by improper input validation. By persuading a victim to open a specially crafted TAR file,...

apache-commons-lang:LocaleUtilsFuzzer: Security exception in java.base/java.util.Arrays.copyOf

Detailed Report: https://oss-fuzz.com/testcase?key=6136486927663104 Project: apache-commons-lang Fuzzing Engine: libFuzzer Fuzz Target: LocaleUtilsFuzzer Job Type: libfuzzerasanapache-commons-lang Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

A flaw was found in Apache Tomcat. An incomplete cleanup vulnerability with the internal fork of the Commons FileUpload package exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be delete...

Security Bulletin: IBM Jazz Reporting Service is vulnerable to a denial of service due to Apache Commons FileUpload (CVE-2023-24998)

Summary There is a vulnerability in the Apache Commons FileUpload library used by BM Jazz Reporting Service. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caus...

Security Bulletin: IBM Jazz Reporting Service is vulnerable to a remote attacker to traverse directories due to Apache Commons IO (CVE-2021-29425)

Summary A vulnerability has been identified in the Apache Commons IO library, which is included in IBM® Jazz Reporting Service. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2021-29425 DESCRIPTION: Apache Commons IO could allow a remote attacker to traverse...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Apache Commons Compress

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Apache Commons Compress. Vulnerability Details CVEID: CVE-2023-42503 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by improper input validation. By persuading a...

ch.hortis.sonar:sonar-application (>=1.0-beta, <=1.0.2), ch.hortis.sonar:sonar-commons (>=1.0-beta, <=1.0.2) +24 more potentially affected by CVE-2023-6378 via ch.qos.logback:logback-core (0.9.8)

ch.qos.logback:logback-core MAVEN version 0.9.8 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.hortis.sonar:sonar-application =1.0-beta, =1.0-beta, =1.0-beta, =1.0-beta, =1.0-beta, =0.9.9, =0.9.9,...

ch.hortis.sonar:sonar-application (>=1.0-beta, <=1.0.2), ch.hortis.sonar:sonar-commons (>=1.0-beta, <=1.0.2) +22 more potentially affected by CVE-2023-6378 via ch.qos.logback:logback-classic (0.9.8)

ch.qos.logback:logback-classic MAVEN version 0.9.8 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-classic and may be impacted: - ch.hortis.sonar:sonar-application =1.0-beta, =1.0-beta, =1.0-beta, =1.0-beta, =1.0-beta, =0.9.9,...

apache-commons-compress:CompressorSnappyFuzzer: Security exception in org.apache.commons.compress.compressors.snappy.FramedSnappyCompressorInputStream

Detailed Report: https://oss-fuzz.com/testcase?key=4673502053269504 Project: apache-commons-compress Fuzzing Engine: libFuzzer Fuzz Target: CompressorSnappyFuzzer Job Type: libfuzzerasanapache-commons-compress Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Security Bulletin: Apache Commons Compress is vulnerable to CVE-2023-42503 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses Apache Commons Compress which is vulnerable to CVE-2023-42503. Vulnerability Details CVEID: CVE-2023-42503 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by improper input validation. By persuading a...

apache-commons-lang:SerializationUtilsFuzzer: Security exception in jaz.Zer.reportFinding

Detailed Report: https://oss-fuzz.com/testcase?key=6206408512897024 Project: apache-commons-lang Fuzzing Engine: libFuzzer Fuzz Target: SerializationUtilsFuzzer Job Type: libfuzzerasanapache-commons-lang Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

apache-commons-jxpath:JXPathFuzzer: Security exception in org.apache.commons.jxpath.ri.compiler.CoreOperation.toString

Detailed Report: https://oss-fuzz.com/testcase?key=5448317307584512 Project: apache-commons-jxpath Fuzzing Engine: libFuzzer Fuzz Target: JXPathFuzzer Job Type: libfuzzerasanapache-commons-jxpath Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Security Bulletin: IBM Sterling B2B Integrator is vulnerable to denial of service due to Apache Commons FileUpload (CVE-2023-24998)

Summary IBM Sterling B2B Integrator uses Apache Commons FileUpload. Vulnerability Details CVEID: CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processed in the file upload function. By...

apache-commons-codec:PhoneticEngineFuzzer: Security exception in java.base/java.util.HashMap.resize

Detailed Report: https://oss-fuzz.com/testcase?key=6726368628703232 Project: apache-commons-codec Fuzzing Engine: libFuzzer Fuzz Target: PhoneticEngineFuzzer Job Type: libfuzzerasanapache-commons-codec Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Oracle Linux 8 : tomcat (ELSA-2023-7065)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7065 advisory. - Resolves: 2210630 CVE-2023-28709 tomcat - Resolves: 2181448 CVE-2023-28708 tomcat: not including the secure attribute causes information disclosure...