Ubuntu: Security Advisory (USN-6037-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Apache Commons Net vulnerability (USN-6037-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6037-1 advisory. ZeddYu Lu discovered that the FTP client from Apache Commons Net trusted the host from PASV responses by default. A remote...

Oracle Business Intelligence Enterprise Edition (OAS) (Apr 2023 CPU)

The versions of Oracle Business Intelligence Enterprise Edition OBIEE OAS installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory. - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics componen...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® Graph

Summary IBM has released the below fix for IBM Db2® Graph in response to multiple vulnerabilities found in multiple components Vulnerability Details CVEID:CVE-2022-41881 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a StackOverflowError in HAProxyMessageDecoder. By sending a...

Security Bulletin: Vulnerability in Apache Commons FileUpload (CVE-2023-24998) affects Power HMC

Summary Apache Commons FileUpload is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request...

org.xwiki.commons:xwiki-commons-diff-script (>=11.6-rc-1, <=14.9), org.xwiki.commons:xwiki-commons-diff-xml (>=11.6-rc-1, <=14.9) +57 more potentially affected by CVE-2023-29528 via org.xwiki.commons:xwiki-commons-xml (>=4.2-milestone-1, <=14.9)

org.xwiki.commons:xwiki-commons-xml MAVEN version =4.2-milestone-1, =11.6-rc-1, =11.6-rc-1, =6.2-milestone-1, =5.2-milestone-1, =10.7-rc-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-1, =14.8-rc-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-3, =4.2-milestone-1, =14.8-rc-1,...

GHSA-X37V-36WV-6V6H Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml

Impact The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricte...

org.xwiki.commons:xwiki-commons-diff-script (>=11.6-rc-1, <=14.9), org.xwiki.commons:xwiki-commons-diff-xml (>=11.6-rc-1, <=14.9) +57 more potentially affected by CVE-2023-29528 via org.xwiki.commons:xwiki-commons-xml (>=4.2-milestone-1, <=14.9)

org.xwiki.commons:xwiki-commons-xml MAVEN version =4.2-milestone-1, =11.6-rc-1, =11.6-rc-1, =6.2-milestone-1, =5.2-milestone-1, =10.7-rc-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-1, =14.8-rc-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-3, =4.2-milestone-1, =14.8-rc-1,...

CVE-2023-29528

XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting...

org.xwiki.commons:xwiki-commons-diff-script (>=11.6-rc-1, <=14.9), org.xwiki.commons:xwiki-commons-diff-xml (>=11.6-rc-1, <=14.9) +57 more potentially affected by CVE-2023-29528 via org.xwiki.commons:xwiki-commons-xml (>=4.2-milestone-1, <=14.9)

org.xwiki.commons:xwiki-commons-xml MAVEN version =4.2-milestone-1, =11.6-rc-1, =11.6-rc-1, =6.2-milestone-1, =5.2-milestone-1, =10.7-rc-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-1, =14.8-rc-1, =4.2-milestone-1, =4.2-milestone-1, =4.2-milestone-3, =4.2-milestone-1, =14.8-rc-1,...

CVE-2023-29528 Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml

XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting...

Security Bulletin: Security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2023-24998)

Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about a denial of service security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security...

Security Bulletin: IBM Security Verify Governance is vulnerable to denial of service ( CVE-2023-24998)

Summary IBM Security Verify Governance is vulnerable to a denial of service within Apache Commons FileUpload. The fix involves upgrading the JAR to the patched version. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of...

Security Bulletin: IBM WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On is vulnerable to a denial of service due to Apache Commons FileUpload (CVE-2023-24998)

Summary Security Bulletin: IBM WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On is vulnerable to a denial of service due to Apache Commons FileUpload CVE-2023-24998. This has been addressed in the remediation section. Vulnerability Details Refer ...

CVE-2023-29528: Improper Neutralization of Input During Web Page Generation

XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting...

XWiki Commons Cross-Site Scripting Vulnerabilities

XWiki Commons is a technology library shared by several other top XWiki projects of the French XWiki Foundation. A cross-site scripting vulnerability exists in XWiki Commons. An attacker can exploit this vulnerability to inject arbitrary HTML code...

Security Bulletin: Multiple Vulnerabilities in Apache Commons Compress affect WebSphere Application Server used by IBM Maximo Application Suite

Summary Multiple Vulnerabilities in Apache Commons Compress affect WebSphere Application Server used by IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Case Manager (CVE-2023-24998)

Summary IBM WebSphere Application Server is shipped as a component of IBM Case Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Oracle WebLogic Server (Apr 2023 CPU)

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the April 2023 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities, including: - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware...

Security Bulletin: Vulnerabilities in Apache Shiro (CVE-2022-40664) and Apache Commons FileUpload (CVE-2023-24998) affect IBM WebSphere Service Registry and Repository.

Summary A bypass security restrictions vulnerability in Apache Shiro CVE-2022-40664 and a denial of service vulnerability in Apache Commons File Upload CVE-2023-24998 affect IBM WebSphere Service Registry and Repository. Vulnerability Details CVEID:CVE-2022-40664 DESCRIPTION: Apache Shiro could...