Security Bulletin: Vulnerability in Apache Commons FileUpload affects IBM Spectrum Control and Tivoli Storage Productivity Center (CVE-2016-1000031)

Summary A vulnerability in Apache Commons FileUpload affects IBM Spectrum Control formerly Tivoli Storage Productivity Center. Apache Commons FileUpload, as used in IBM Websphere Liberty and other products, could allow a remote attacker to execute arbitrary code on the system, caused by...

jenkins-2-plugins/docker-commons: does not sanitize the name of an image or a tag which could result in an OS command execution

An OS command execution vulnerability was found in the Jenkins Docker Commons plugin. Due to a lack of sanitization in the name of an image or a tag, an attacker with Item/Configure permission or the ability to control the contents of a previously configured job’s SCM repository may be able to...

jenkins-2-plugins/docker-commons: does not sanitize the name of an image or a tag which could result in an OS command execution

An OS command execution vulnerability was found in the Jenkins Docker Commons plugin. Due to a lack of sanitization in the name of an image or a tag, an attacker with Item/Configure permission or the ability to control the contents of a previously configured job’s SCM repository may be able to...

RHEL 8 : OpenShift Container Platform 4.8.31 (RHSA-2022:0483)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0483 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

RHEL 8 : OpenShift Container Platform 4.7.43 (RHSA-2022:0491)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0491 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

Denial of service attacks due to use of vulnerable version of apache-commons-compress package

Affected versions of Atlassian Jira Service Server and Data Center allow an unauthenticated attacker to perform a denial of service attack against services that use the apache-commons-compress package. The affected versions are before version 8.13.19, from version 8.14.0 before 8.20.6, from versi...

Security Bulletin: Multiple vulnerabilities in the Apache Commons Compress library used by WebSphere Application Server Liberty shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises

Summary There are multiple vulnerabilities in the Apache Commons Compress library that is used by WebSphere Application Server Liberty shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. This has been addressed. The recommended solution is to manually...

Jenkins Enterprise and Operations Center < 2.277.43.0.5 / 2.319.2.5 Multiple Vulnerabilities (CloudBees Security Advisory 2022-01-12)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.277.x prior to 2.277.43.0.5, or 2.x prior to 2.319.2.5. It is, therefore, affected by a multiple vulnerabilities, including the following: - Jenkins Docker Commons Plugin 1.17 and earlier does not...

com.facebook.presto:presto-cassandra (>=0.146, <=0.166), com.stratio.cassandra:cassandra-lucene-index-plugin (2.1.6.2) +5 more potentially affected by CVE-2021-44521 via org.apache.cassandra:cassandra-all (2.1.6)

org.apache.cassandra:cassandra-all MAVEN version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.facebook.presto:presto-cassandra =0.146, =0.1.0.final, =0.1.0.final, =0.4.0.final,...

jenkins-2-plugins/docker-commons: does not sanitize the name of an image or a tag which could result in an OS command execution

An OS command execution vulnerability was found in the Jenkins Docker Commons plugin. Due to a lack of sanitization in the name of an image or a tag, an attacker with Item/Configure permission or the ability to control the contents of a previously configured job’s SCM repository may be able to...

Server-side request forgery (SSRF) in Apache XmlGraphics Commons

Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...

GHSA-FMJ2-7WX8-QJ4V Server-side request forgery (SSRF) in Apache XmlGraphics Commons

Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...

net.sf.barcode4j:barcode4j-fop-ext (2.0), net.sf.barcode4j:barcode4j-fop-ext-complete (2.0) +1 more potentially affected by CVE-2020-11988 via org.apache.xmlgraphics:xmlgraphics-commons (1.1)

org.apache.xmlgraphics:xmlgraphics-commons MAVEN version 1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.xmlgraphics:xmlgraphics-commons and may be impacted: - net.sf.barcode4j:barcode4j-fop-ext 2.0 -...

ca.ace-design-lab:island-arena (3.0), ca.ace-design-lab:island-engine (3.0) +104 more potentially affected by CVE-2020-11988 via org.apache.xmlgraphics:xmlgraphics-commons (1.2)

org.apache.xmlgraphics:xmlgraphics-commons MAVEN version 1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.xmlgraphics:xmlgraphics-commons and may be impacted: - ca.ace-design-lab:island-arena 3.0 - ca.ace-design-lab:island-engine 3.0 -...

com.day.cq:cq-rewriter (5.1.4), net.sourceforge.jeuclid:jeuclid-cli (3.1.1) +5 more potentially affected by CVE-2020-11988 via org.apache.xmlgraphics:xmlgraphics-commons (1.3)

org.apache.xmlgraphics:xmlgraphics-commons MAVEN version 1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.xmlgraphics:xmlgraphics-commons and may be impacted: - com.day.cq:cq-rewriter 5.1.4 - net.sourceforge.jeuclid:jeuclid-cli 3.1.1 -...

com.agilejava.docbkx:docbkx-fop-support (>=2.0.9, <=2.0.11), com.agilejava.docbkx:docbkx-maven-plugin (>=2.0.9, <=2.0.11) +138 more potentially affected by CVE-2020-11988 via org.apache.xmlgraphics:xmlgraphics-commons (1.3.1)

org.apache.xmlgraphics:xmlgraphics-commons MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.xmlgraphics:xmlgraphics-commons and may be impacted: - com.agilejava.docbkx:docbkx-fop-support =2.0.9, =2.0.9, =5.3.0, =0.3, =0.4,...

cn.t:media-util (>=1.0-release, <=1.0.13.release), cn.testnewbie.automation:automation-ui (1.3.2) +126 more potentially affected by CVE-2020-11988 via org.apache.xmlgraphics:xmlgraphics-commons (1.4)

org.apache.xmlgraphics:xmlgraphics-commons MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.xmlgraphics:xmlgraphics-commons and may be impacted: - cn.t:media-util =1.0-release, =1.2.3-release, =2.0.12, =2.0.12, =1.0.0, =1.0,...

ar.com.fdvs:dynamicjasper (>=5.1.2, <=5.3.2), br.com.jarch:jarch-apt (>=20.7.0, <=22.9.0) +178 more potentially affected by CVE-2020-11988 via org.apache.xmlgraphics:xmlgraphics-commons (1.5)

org.apache.xmlgraphics:xmlgraphics-commons MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.xmlgraphics:xmlgraphics-commons and may be impacted: - ar.com.fdvs:dynamicjasper =5.1.2, =20.7.0, =20.7.0, =2.0.15, =2.0.15, =0.3,...

ai.tock:tock-shared (>=19.9.4, <=26.9.0), at.austriapro:ebinterface-rendering (1.0.0) +1466 more potentially affected by CVE-2020-11988 via org.apache.xmlgraphics:xmlgraphics-commons (>=2.0, <=2.4)

org.apache.xmlgraphics:xmlgraphics-commons MAVEN version =2.0, =19.9.4, =1.0.7, =1.10.2, =1.13.0, =0.1.1, =0.5.0, =0.11.1, =0.0.2, =0.0.1, =0.0.1, =22.10.0, =25.12.0 and more Source cves: CVE-2020-11988 Source advisory: OSV:GHSA-FMJ2-7WX8-QJ4V...

ai.tock:tock-shared (>=19.9.4, <=26.9.0), at.austriapro:ebinterface-rendering (1.0.0) +1466 more potentially affected by CVE-2020-11988 via org.apache.xmlgraphics:xmlgraphics-commons (>=2.0, <=2.4)

org.apache.xmlgraphics:xmlgraphics-commons MAVEN version =2.0, =19.9.4, =1.0.7, =1.10.2, =1.13.0, =0.1.1, =0.5.0, =0.11.1, =0.0.2, =0.0.1, =0.0.1, =22.10.0, =25.12.0 and more Source cves: CVE-2020-11988 Source advisory: GHSA-FMJ2-7WX8-QJ4V...