GHSA-P7VM-PHXX-G722 Improper Input Validation in Apache Commons Email

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers...

Improper Input Validation in Apache Commons Email

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers...

at.researchstudio.sat:won-owner-webapp (0.3), at.researchstudio.sat:won-utils-mail (>=0.2, <=0.9) +1394 more potentially affected by CVE-2017-9801 via org.apache.commons:commons-email (>=1.1, <=1.4)

org.apache.commons:commons-email MAVEN version =1.1, =0.2, =1.0.0, =1.2.8, =1.0.2, =1.2, =1.0.0, =1.0.1, =0.0.1, =2.23.0, =1.1, =1.4 and more Source cves: CVE-2017-9801 Source advisory: OSV:GHSA-P7VM-PHXX-G722...

Improper Restriction of XML External Entity Reference in Jelly

During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...

com.canoo:webtest (>=586, <=1393), com.flexiblewebsolutions.xdriveunit:xdriveunit (0.3) +79 more potentially affected by CVE-2017-12621 via commons-jelly:commons-jelly (>=1.0-beta-4, <=1.0)

commons-jelly:commons-jelly MAVEN version =1.0-beta-4, =586, =0.1, =1.0, =20050708.205531, =1.2, =1.0-m5, =1.0.1, =1.3, =1.9 - jepi:jepi 1.0 - marmalade:marmalade-compat-jelly 1.0-alpha-3 - maven-plugins:maven-sourceforge-plugin 1.3 and more Source cves: CVE-2017-12621 Source advisory:...

com.canoo:webtest (>=586, <=1393), com.flexiblewebsolutions.xdriveunit:xdriveunit (0.3) +79 more potentially affected by CVE-2017-12621 via commons-jelly:commons-jelly (>=1.0-beta-4, <=1.0)

commons-jelly:commons-jelly MAVEN version =1.0-beta-4, =586, =0.1, =1.0, =20050708.205531, =1.2, =1.0-m5, =1.0.1, =1.3, =1.9 - jepi:jepi 1.0 - marmalade:marmalade-compat-jelly 1.0-alpha-3 - maven-plugins:maven-sourceforge-plugin 1.3 and more Source cves: CVE-2017-12621 Source advisory:...

GHSA-69CJ-G7MW-MH72 Jenkins Docker Commons Plugin allows any user with Overall/Read permission to get list of valid credentials IDs

Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to authenticate with a Docker Registry. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid...

Jenkins Docker Commons Plugin allows any user with Overall/Read permission to get list of valid credentials IDs

Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to authenticate with a Docker Registry. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid...

com.aliyun.www:aliyun-container-service-deploy (>=0.1.0, <=0.1.1), com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9) +48 more potentially affected by CVE-2017-1000094 via org.jenkins-ci.plugins:docker-commons (>=1.0, <=1.6)

org.jenkins-ci.plugins:docker-commons MAVEN version =1.0, =0.1.0, =1.9.2-beta, =1.0-beta-1, =1.2, =1.0-beta-2, =0.1.0-alpha5, =1.0.0-b02, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.1.0-beta-2 and more Source cves: CVE-2017-1000094 Source advisory: OSV:GHSA-69CJ-G7MW-MH72...

com.aliyun.www:aliyun-container-service-deploy (>=0.1.0, <=0.1.1), com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9) +48 more potentially affected by CVE-2017-1000094 via org.jenkins-ci.plugins:docker-commons (>=1.0, <=1.6)

org.jenkins-ci.plugins:docker-commons MAVEN version =1.0, =0.1.0, =1.9.2-beta, =1.0-beta-1, =1.2, =1.0-beta-2, =0.1.0-alpha5, =1.0.0-b02, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.1.0-beta-2 and more Source cves: CVE-2017-1000094 Source advisory: GHSA-69CJ-G7MW-MH72...

Security Bulletin: Vulnerability in Apache Commons affects IBM Standards Processing Engine (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM Standards Processing Engine. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system,...

cloud.genesys:web-messaging-sdk (>=3.0.0, <=5.0.0), cn.dceast.platform:platform-security-starter (2.2.3) +301 more potentially affected by CVE-2014-3604 via ca.juliusdavies:not-yet-commons-ssl (>=0.3.9, <=0.3.11)

ca.juliusdavies:not-yet-commons-ssl MAVEN version =0.3.9, =3.0.0, =1.2, =1.1, =0.9.0, =0.9.0, =12.1.0, =12.1.1, =12.1.2, =12.1.0, =12.1.4, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.0.83-rc1, =1.0.112-release and more Source cves: CVE-2014-3604 Source advisory: OSV:GHSA-CMXJ-WX9V-52QR...

cloud.genesys:web-messaging-sdk (>=3.0.0, <=5.0.0), cn.dceast.platform:platform-security-starter (2.2.3) +301 more potentially affected by CVE-2014-3604 via ca.juliusdavies:not-yet-commons-ssl (>=0.3.9, <=0.3.11)

ca.juliusdavies:not-yet-commons-ssl MAVEN version =0.3.9, =3.0.0, =1.2, =1.1, =0.9.0, =0.9.0, =12.1.0, =12.1.1, =12.1.2, =12.1.0, =12.1.4, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.0.83-rc1, =1.0.112-release and more Source cves: CVE-2014-3604 Source advisory: GHSA-CMXJ-WX9V-52QR...

Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL

Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

GHSA-CMXJ-WX9V-52QR Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL

Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

GHSA-QX6H-9567-5FQW Arbitrary file write in Apache Commons Fileupload

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance...

Arbitrary file write in Apache Commons Fileupload

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), ai.databand.azkaban:azkaban-common (3.18.0) +5128 more potentially affected by CVE-2013-2186 via commons-fileupload:commons-fileupload (>=1.0-beta-1, <=1.3)

commons-fileupload:commons-fileupload MAVEN version =1.0-beta-1, =0.0.1, =1.0, =3.1.1, =3.1.3 and more Source cves: CVE-2013-2186 Source advisory: OSV:GHSA-QX6H-9567-5FQW...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), ai.databand.azkaban:azkaban-common (3.18.0) +5128 more potentially affected by CVE-2013-2186 via commons-fileupload:commons-fileupload (>=1.0-beta-1, <=1.3)

commons-fileupload:commons-fileupload MAVEN version =1.0-beta-1, =0.0.1, =1.0, =3.1.1, =3.1.3 and more Source cves: CVE-2013-2186 Source advisory: GHSA-QX6H-9567-5FQW...

GHSA-QHXW-54M9-6WWC MitM on Jenkins Maven Plugin

Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient...