Security Bulletin: IBM Content Navigator is vulnerable to DoS due to Apache Commons FileUpload (CVE-2023-24998)

Summary Apache Commons FileUpload is used by IBM Content Navigator as part of the file upload functionailty. CVE-2023-24998. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of reques...

K000135353: Apache Commons Collection serialized object injection vulnerability CVE-2017-15708

Security Advisory Description In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting speciall...

HTML Injection

xwiki-commons-xml is vulnerable to HTML Injection. The vulnerability exists because the HTMLDefinitions function in HTMLDefinitions.java does not properly disallow form-related tags in the HTML sanitizer, which allows an attacker to inject and execute malicious code such as html/html through the...

apache-commons-jxpath:JXPathFuzzer: Security exception in com.code_intelligence.jazzer.sanitizers.ServerSideRequestForgery.checkSsrf

Detailed Report: https://oss-fuzz.com/testcase?key=6557152538656768 Project: apache-commons-jxpath Fuzzing Engine: libFuzzer Fuzz Target: JXPathFuzzer Job Type: libfuzzerasanapache-commons-jxpath Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

org.xwiki.commons:xwiki-commons-diff-script (>=14.6-rc-1, <=14.10.5), org.xwiki.commons:xwiki-commons-diff-xml (>=14.6-rc-1, <=14.10.5) +35 more potentially affected by CVE-2023-36471 via org.xwiki.commons:xwiki-commons-xml (>=14.6-rc-1, <=14.10.5)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.6-rc-1, =14.8-rc-1, =14.10.5 and more Source cves: CVE-2023-36471 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=15.0-rc-1, <=15.1), org.xwiki.commons:xwiki-commons-diff-xml (>=15.0-rc-1, <=15.1) +35 more potentially affected by CVE-2023-36471 via org.xwiki.commons:xwiki-commons-xml (>=15.0-rc-1, <=15.1)

org.xwiki.commons:xwiki-commons-xml MAVEN version =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.1 and more Source cves: CVE-2023-36471 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=15.0-rc-1, <=15.1), org.xwiki.commons:xwiki-commons-diff-xml (>=15.0-rc-1, <=15.1) +35 more potentially affected by CVE-2023-36471 via org.xwiki.commons:xwiki-commons-xml (>=15.0-rc-1, <=15.1)

org.xwiki.commons:xwiki-commons-xml MAVEN version =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.1 and more Source cves: CVE-2023-36471 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=14.6-rc-1, <=14.10.5), org.xwiki.commons:xwiki-commons-diff-xml (>=14.6-rc-1, <=14.10.5) +35 more potentially affected by CVE-2023-36471 via org.xwiki.commons:xwiki-commons-xml (>=14.6-rc-1, <=14.10.5)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.6-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.8-rc-1, =14.6-rc-1, =14.8-rc-1, =14.10.5 and more Source cves: CVE-2023-36471 Source...

Security Bulletin: Multiple vulnerabilities for IBM WebSphere Application Server addressed in IBM Security Verify Governance (CVE-2022-39161, CVE-2023-24998, CVE-2023-27554)

Summary Multiple security vulnerabilities for IBM WebSphere Application Server traditional and Liberty have been addressed in IBM Security Verify Governance - Identity Manager Virtual Appliance component. Vulnerability Details CVEID:CVE-2022-39161 DESCRIPTION: IBM WebSphere Application Server 7.0...

jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name

It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

Critical: Red Hat Security Advisory: Red Hat Fuse 7.12 release and security update

A minor version update from 7.11 to 7.12 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring...

Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing

An out-of-bounds OOB write flaw was found in Apache Commons BCEL API. This flaw can be used to produce arbitrary bytecode and may abuse applications that pass attacker-controlled data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected...

CVE-2023-36471 HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishi...

CVE-2023-36471 HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishi...

CVE-2023-36471

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishi...

XWiki Commons Cross-Site Scripting Vulnerabilities

XWiki Commons is a technology library shared by several other top-level XWiki projects of the French XWiki Foundation. A cross-site scripting vulnerability exists in XWiki Commons versions 9.6-rc-1 through 14.10.6 and 15.0-rc-1 through 15.2-rc-1, which stems from the inclusion of HTML cleaners in...

CVE-2023-36471: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishi...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is shipped with, or a required product for, IBM Tivoli Network Manager IP Edition (CVE-2012-5783).

Summary IBM WebSphere Application Server is shipped with IBM Tivoli Network Manager IP Edition versions 3.9 and 4.1.1; IBM WebSphere Application Server is a required product for IBM Tivoli Network Manager IP Edition version 4.2. Information about a security vulnerability affecting IBM WebSphere...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is shipped with, or a required product for, IBM Tivoli Netcool Configuration Manager (CVE-2012-5783).

Summary IBM WebSphere Application Server is shipped with IBM Tivoli Netcool Configuration Manager version 6.4.1; IBM WebSphere Application Server is a required product for IBM Tivoli Netcool Configuration Manager version 6.4.2. Information about a security vulnerability affecting IBM WebSphere...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in IBM WebSphere Application Server Liberty

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of IBM WebSphere Application Server Liberty . Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the...