GHSA-JJ4F-P7VV-J4V9 Arbitrary code execution in Apache Druid

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...

The vulnerability of the Outside In Filters component within the Oracle Outside In Technology SDK allows a hacker to gain access to data for reading purposes.

The vulnerability of the Outside In Filters component within Oracle’s SDK for software development tools exists due to insufficient testing of input data. Exploiting this vulnerability could allow a malicious actor to gain access to data through HTTP requests...

Vulnerabilities fixed in AWStats

Vulnerabilities have been fixed in AWStats. An unauthenticated malicious party could exploit the vulnerabilities to perform a path traversal attack that could gain access to arbitrary files. In doing so, the vulnerabilities can only exploited only to read key/value pairs that can be parsed by...

CVE-2021-2219

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: SQR. Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2021-2142

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. The supported version that is affected is 10.3.6.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful...

CVE-2021-2242

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Filters. The supported version that is affected is 8.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In...

Oracle Enterprise Manager Base Platform 安全漏洞

Oracle Enterprise Manager Base Platform is a complete installer that includes OMS, agents, repositories, and management plug-ins. A security vulnerability exists in the UI Framework component of Oracle Enterprise Manager Base Platform version 13.4.0.0. An attacker could use this vulnerability to...

PT-2021-17628 · Exif +1 · Exif +1

Name of the Vulnerable Software and Affected Versions: exif versions 0.6.22 and earlier Description: The issue allows attackers to cause a Denial of Service DoS by uploading a malicious JPEG file, causing the application to crash. This occurs when printing out XML formatted EXIF data using the ex...

CVE-2021-26919

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...

CVE-2021-26919

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...

RHEL 7 / 8 : OpenShift Container Platform 4.5.34 (RHSA-2021:0713)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0713 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

JetBrains Kotlin 授权问题漏洞

JetBrains Kotlin is a statically typed programming language from the Czech company JetBrains that runs on the Java Virtual Machine. An authorization issue vulnerability exists in JetBrains Kotlin before 1.4.2, which stems from insecure permissions and can be exploited by an attacker to read data...

CVE-2021-2040

Vulnerability in the Oracle Argus Safety product of Oracle Health Sciences Applications component: Case Form, Local Affiliate Form. The supported version that is affected is 8.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2020-8274

Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code 'Code Injection' by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to...

UBUNTU-CVE-2020-14781

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JNDI. Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

OpenJDK: Incorrect handling of access control context in ForkJoinPool (Libraries, 8237117)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2020-2966

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2020-14638

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Sample apps. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

UBUNTU-CVE-2020-14577

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to...

PT-2020-3598

Name of the Vulnerable Software and Affected Versions Java SE versions 8u251, 11.0.7, and 14.0.1 Java SE Embedded version 8u251 Description The issue is related to insufficient input validation in the Libraries component of Oracle Java SE and Java SE Embedded. It allows an unauthenticated attacke...