CVE-2022-32549: Improper Output Neutralization for Logs

Apache Sling Commons Log = 5.4.0 and Apache Sling API = 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files...

PT-2022-21360

Name of the Vulnerable Software and Affected Versions Apache Sling Commons Log versions 5.4.0 and earlier Apache Sling API versions 2.25.0 and earlier Description The issue allows an attacker to forge logs, potentially covering their tracks by injecting fake logs and corrupting log files. This is...

MAL-2022-6749 Malicious code in ui-dash-commons-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bad92b6a151837959646c064223494d282ed529116aeff99aa3451c34237d3ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in ui-dash-commons-ui

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2022-7065 Malicious code in web-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d29262f3e0b6ac750fdc3527228e627f7d8c893f36327f2eed87a37f889b1bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in web-commons

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in web-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d29262f3e0b6ac750fdc3527228e627f7d8c893f36327f2eed87a37f889b1bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-227 Malicious code in @eg-maps/commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 683771ccbf7865145f726b98e031ef733f7c549710df47bd019217e6373df1e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @eg-maps/commons

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @eg-maps/commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 683771ccbf7865145f726b98e031ef733f7c549710df47bd019217e6373df1e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-621 Malicious code in @talent-journey/tj-fe-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47b2836a71fa5634cdf5d8bb067e519b9a5ca1f8eff64b3142d69c88590b7d66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @talent-journey/tj-fe-commons

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @talent-journey/tj-fe-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47b2836a71fa5634cdf5d8bb067e519b9a5ca1f8eff64b3142d69c88590b7d66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sentiance.commons.sentikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d51b5f9247d7b8428ffc0b1ea123bda0bbf9ac55d055ed542a04d88e23fa50a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @w3-commons/js-build-resources

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

artemis-commons: Apache ActiveMQ Artemis DoS

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability DoS through uncontrolled resource consumption of memory...

Apache Commons FileUpload MultipartStream DoS

The vulnerability of the MultipartStream.java file in the Apache Commons FileUpload library is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to cause a service failure by manipulating the Content-Type header created by the...

Security Bulletin: Apache Commons as used by IBM QRadar SIEM is vulnerable to denial of service (CVE-2021-35515, CVE-2021-35516, CVE-2021-36090, CVE-2021-35517)

Summary Apache Commons as used by IBM QRadar SIEM is vulnerable to denial of service. IBM has addressed the relevant CVEs. Vulnerability Details CVEID: CVE-2021-35515 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an infinite loop flaw in the construction of...

maven:3.5 security update

An update is available for apache-commons-io, atinject, maven-shared-utils, plexus-cipher, aopalliance, plexus-classworlds, glassfish-el, apache-commons-cli, guava20, plexus-containers, plexus-sec-dispatcher, httpcomponents-client, maven-resolver, jansi-native, apache-commons-logging,...

Security Bulletin: The version of IBM WebSphere Liberty shipped with IBM MQ is vulnerable to multiple CVEs (CVE-2021-29842,CVE-2021-33517, CVE-2021-36090)

Summary The version of IBM WebSphere Liberty Profile that is shipped with IBM MQ is vulnerable to Information Disclosure. IBM WebSphere Liberty Profile is used to provide WebUI and REST API capabilities. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerabl...