OESA-2022-1649 xmlgraphics-commons security update

Apache XML Graphics Commons is a library that consists of several reusable components used by Apache Batik and Apache FOP. Many of these components can easily be used separately outside the domains of SVG and XSL-FO. You will find components such as a PDF library, an RTF library, Graphics2D...

VulnCheck KEV: CVE-2014-0114

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrar...

maven:3.6 security and enhancement update

An update is available for apache-commons-io, atinject, jsr-305, maven-shared-utils, plexus-cipher, aopalliance, plexus-classworlds, guava, apache-commons-cli, plexus-containers, plexus-sec-dispatcher, httpcomponents-client, maven-resolver, apache-commons-lang3, plexus-interpolation, sisu,...

Incorrect Default Permissions in Apache Commons FileUpload

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), ai.databand.azkaban:azkaban-common (3.18.0) +3085 more potentially affected by CVE-2013-0248 via commons-fileupload:commons-fileupload (>=1.0, <=1.2.1)

commons-fileupload:commons-fileupload MAVEN version =1.0, =0.0.1, =1.0, =3.1.1, =0.0.1, =0.0.3 and more Source cves: CVE-2013-0248 Source advisory: OSV:GHSA-VM69-474V-7Q2W...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), ai.databand.azkaban:azkaban-common (3.18.0) +3085 more potentially affected by CVE-2013-0248 via commons-fileupload:commons-fileupload (>=1.0, <=1.2.1)

commons-fileupload:commons-fileupload MAVEN version =1.0, =0.0.1, =1.0, =3.1.1, =0.0.1, =0.0.3 and more Source cves: CVE-2013-0248 Source advisory: GHSA-VM69-474V-7Q2W...

org.springframework:spring-portlet (2.0.3), org.springframework:spring-remoting (2.0.3) +4 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (2.0.3)

org.springframework:spring-web MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0.3 - org.springframework:spring-remoting 2.0.3 -...

Spring Data Commons < 1.13.11 / 2.x < 2.0.6 RCE

The version of Spring Data Commons installed on the remote host is affected by a remote code execution vulnerability. Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=10.7-rc-1, <=12.6.6), org.xwiki.rendering:xwiki-rendering-syntax-xwiki10 (>=3.2-milestone-3, <=7.4.6) +1 more potentially affected by CVE-2022-24897 via org.xwiki.commons:xwiki-commons-velocity (>=3.2-milestone-3, <=12.6.6)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =3.2-milestone-3, =10.7-rc-1, =3.2-milestone-3, =4.3-milestone-2, =12.6.6 Source cves: CVE-2022-24897 Source advisory: MEND:CVE-2022-24897...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=12.7, <=12.10.2), org.xwiki.rendering:xwiki-rendering-test (>=12.7, <=12.10.2) potentially affected by CVE-2022-24897 via org.xwiki.commons:xwiki-commons-velocity (>=12.7, <=12.10.2)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =12.7, =12.7, =12.7, =12.10.2 Source cves: CVE-2022-24897 Source advisory: MEND:CVE-2022-24897...

XWiki Commons Path traversal vulnerability

XWiki Commons is a technology library shared by several other top XWiki projects. XWiki Commons suffers from a security vulnerability that stems from velocity scripts not being properly sandboxed to perform read or write operations to the file system using the Java File API...

apache-commons-jxpath:JXPathFuzzer: Uncaught exception in jaz.Zer.<clinit>

Detailed Report: https://oss-fuzz.com/testcase?key=4854085561483264 Project: apache-commons-jxpath Fuzzing Engine: libFuzzer Fuzz Target: JXPathFuzzer Job Type: libfuzzerasanapache-commons-jxpath Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: jaz.Zer...

XML External Entity (XXE) Injection

xwiki-commons-xml is vulnerable to XML External Entity XXE Injection. The parse function of XMLUtils.java does not disable access to external entities by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the server...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=10.7-rc-1, <=12.6.6), org.xwiki.rendering:xwiki-rendering-syntax-xwiki10 (>=3.2-milestone-3, <=7.4.6) +1 more potentially affected by CVE-2022-24897 via org.xwiki.commons:xwiki-commons-velocity (>=3.2-milestone-3, <=12.6.6)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =3.2-milestone-3, =10.7-rc-1, =3.2-milestone-3, =4.3-milestone-2, =12.6.6 Source cves: CVE-2022-24897 Source advisory: OSV:GHSA-CVX5-M8VG-VXGC...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=10.7-rc-1, <=12.6.6), org.xwiki.rendering:xwiki-rendering-syntax-xwiki10 (>=3.2-milestone-3, <=7.4.6) +1 more potentially affected by CVE-2022-24897 via org.xwiki.commons:xwiki-commons-velocity (>=3.2-milestone-3, <=12.6.6)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =3.2-milestone-3, =10.7-rc-1, =3.2-milestone-3, =4.3-milestone-2, =12.6.6 Source cves: CVE-2022-24897 Source advisory: GHSA-CVX5-M8VG-VXGC...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=12.7, <=12.10.2), org.xwiki.rendering:xwiki-rendering-test (>=12.7, <=12.10.2) potentially affected by CVE-2022-24897 via org.xwiki.commons:xwiki-commons-velocity (>=12.7, <=12.10.2)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =12.7, =12.7, =12.7, =12.10.2 Source cves: CVE-2022-24897 Source advisory: OSV:GHSA-CVX5-M8VG-VXGC...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=12.7, <=12.10.2), org.xwiki.rendering:xwiki-rendering-test (>=12.7, <=12.10.2) potentially affected by CVE-2022-24897 via org.xwiki.commons:xwiki-commons-velocity (>=12.7, <=12.10.2)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =12.7, =12.7, =12.7, =12.10.2 Source cves: CVE-2022-24897 Source advisory: GHSA-CVX5-M8VG-VXGC...

Xxe

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External...

CVE-2022-24898

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External...

CVE-2022-24898 Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External...