com.hazelcast.jet.contrib:debezium (=0.1), com.hazelcast.jet.contrib:elasticsearch-5 (>=0.1 <=0.2) +75 more potentially affected by CVE-2022-36437 via com.hazelcast.jet:hazelcast-jet (>=0.3 <=4.5.3)

com.hazelcast.jet:hazelcast-jet MAVEN version =0.3, =0.1, =0.1, =0.1, =2.0.0, =0.1, =0.1, =0.1, =0.1, =3.2, =4.5.3 and more Source cves: CVE-2022-36437 Source advisory: OSV:GHSA-C5HG-MR8R-F6JP...

PT-2022-23369 · Hazelcast +1 · Hazelcast +3

Name of the Vulnerable Software and Affected Versions: Hazelcast versions prior to 3.12.13 Hazelcast versions prior to 4.1.10 Hazelcast versions prior to 4.2.6 Hazelcast versions prior to 5.1.3 Hazelcast Jet versions prior to 4.5.4 Description: The Connection handler in Hazelcast and Hazelcast Je...

Spring Session 2022.0.0-M3 Released

On behalf of the team, I’m pleased to announce the release of Spring Session 2022.0.0-M3. These releases deliver, enhancements, bug fixes, and dependency upgrades. For your convenience, Spring Boot will pick up these artifacts with its upcoming releases. The following modules were updated as part...

[SECURITY] Fedora 36 Update: golang-github-apache-beam-2-2.33.0~RC1-8.fc36

Apache Beam is a unified model for defining both batch and streaming data-parallel processing pipelines, as well as a set of language-specific SDKs for constructing pipelines and Runners for executing them on distributed processing backends, including Apache Flink, Apache Spark, Google Cloud...

[SECURITY] Fedora 35 Update: golang-github-apache-beam-2-2.33.0~RC1-7.fc35

Apache Beam is a unified model for defining both batch and streaming data-parallel processing pipelines, as well as a set of language-specific SDKs for constructing pipelines and Runners for executing them on distributed processing backends, including Apache Flink, Apache Spark, Google Cloud...

[SECURITY] Fedora 36 Update: golang-github-apache-beam-2-2.33.0~RC1-7.fc36

Apache Beam is a unified model for defining both batch and streaming data-parallel processing pipelines, as well as a set of language-specific SDKs for constructing pipelines and Runners for executing them on distributed processing backends, including Apache Flink, Apache Spark, Google Cloud...

RCE in Confluence DataCenter via HazelCast(Confluence) Port

Summary A remote attacker who can connect to the Hazelcast service, running on port 5801 and potentially 5701, is able to execute arbitrary code on all the nodes in a Confluence Data Center through Java deserialization. Vulnerability Details Confluence Data Center uses the third-party software...

Atlassian Confluence 7.4.x < 7.4.17 / 7.13.x < 7.13.7 / 7.14.x < 7.14.3 / 7.15.x < 7.15.2 / 7.16.x < 7.16.4 / 7.17.x < 7.17.4 / 7.18.x < 7.18.1 (CONFSERVER-79017)

The version of Atlassian Confluence installed on the remote host is prior to 7.4.x 7.4.17 / 7.13.x 7.13.7 / 7.14.x 7.14.3 / 7.15.x 7.15.2 / 7.16.x 7.16.4 / 7.17.x 7.17.4 / 7.18.x 7.18.1. It is, therefore, affected by a vulnerability as referenced in the CONFSERVER-79017 advisory. - Summary A remo...

com.erudika:para-cache-hazelcast (>=1.26.0 <=1.40.1), com.erudika:para-client (>=1.13 <=1.45.10) +9 more potentially affected by CVE-2022-1848 via com.erudika:para-core (>=1.13 <=1.45.9)

com.erudika:para-core MAVEN version =1.13, =1.26.0, =1.13, =1.20.0, =1.18.0, =1.28.1, =1.30.0, =1.25.0, =1.29.0, =1.28.0, =1.13, =1.24.4, =1.45.10 Source cves: CVE-2022-1848 Source advisory: OSV:GHSA-4793-8WWH-JXXR...

com.coditory.sherlock:sherlock-mongo-sync (=0.4.3), com.hazelcast.jet.contrib:mongodb (=0.2) +22 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=3.11.0 <=3.11.2)

org.mongodb:mongodb-driver-sync MAVEN version =3.11.0, =0.0.1, =2.1.18, =2.1.18, =2.1.18, =2.0.0, =2.0.0, =2.0.0, =5.0.20.RC, =1.6.1, =3.11.0, =3.11.2 - org.mongojack:mongojack =2.10.1 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

com.buession.cas:buession-cas-ticket (>=2.3.0 <=2.3.2), com.buession.cas:buession-cas-ticket-infinispan (>=2.3.0 <=2.3.2) +525 more potentially affected by CVE-2021-3642 via org.wildfly.security:wildfly-elytron (>=1.11.0.CR1 <=1.15.4.Final)

org.wildfly.security:wildfly-elytron MAVEN version =1.11.0.CR1, =2.3.0, =2.3.0, =2.3.0, =0.8.0, =1.2.6, =1.2.6, =1.2.6, =1.2.6, =1.2.6, =1.2.6, =1.2.6, =1.2.6, =1.2.6, =2.0.20, =0.12, =1.0 and more Source cves: CVE-2021-3642 Source advisory: OSV:GHSA-5499-QJVH-6J7W...

Deserialization of Untrusted Data in Hazelcast

In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code...

br.com.ingenieux:jbake-maven-plugin (>=0.0.3 <=0.0.9), br.com.jarch:jarch-apt (>=20.3.0 <=25.12.0) +450 more potentially affected by CVE-2016-10750 via com.hazelcast:hazelcast (>=1.7 <=3.10.7)

com.hazelcast:hazelcast MAVEN version =1.7, =0.0.3, =20.3.0, =24.2.0, =20.3.0, =2.23.5, =2.23.5, =23.1.0, =2.23.0, =2.23.5, =2.23.5, =2.23.5, =1.0.0, =1.0.0-final, =1.1.0-final and more Source cves: CVE-2016-10750 Source advisory: OSV:GHSA-JV65-PF7V-F7P8...

GHSA-JV65-PF7V-F7P8 Deserialization of Untrusted Data in Hazelcast

In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code...

com.erudika:para-cache-hazelcast (>=1.26.0 <=1.39.0), com.erudika:para-client (>=1.13 <=1.45.10) +9 more potentially affected by CVE-2022-1782 via com.erudika:para-core (>=1.13 <=1.45.10)

com.erudika:para-core MAVEN version =1.13, =1.26.0, =1.13, =1.20.0, =1.18.0, =1.28.1, =1.30.0, =1.25.0, =1.29.0, =1.28.0, =1.13, =1.24.4, =1.45.10 Source cves: CVE-2022-1782 Source advisory: OSV:GHSA-PHVW-R25P-8XV7...

The vulnerability of the Hazelcast platform, a software product for data processing, in the Atlassian Bitbucket Data Center allows a perpetrator to execute arbitrary code.

The vulnerability of the Hazelcast platform, a software product for data processing, in the Atlassian/Bitbucket Data Center environment, relates to the restoration of unreliable data in memory. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code...

com.ahome-it:ahome-tooling-server-core (>=1.0.110-RELEASE <=1.0.114-RELEASE), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.111-RELEASE <=1.0.112-RELEASE) +45 more potentially affected by CVE-2016-10027 via org.igniterealtime.smack:smack-core (>=4.0.0-rc1 <=4.1.8)

org.igniterealtime.smack:smack-core MAVEN version =4.0.0-rc1, =1.0.110-RELEASE, =1.0.111-RELEASE, =1.0.111-RELEASE, =1.0.111-RELEASE, =1.0.111-RELEASE, =0.1.3, =0.1.5, =0.0.0.1, =0.0.0.25, =0.1, =1.2.4, =0.2.5, =1.1.9, =1.1.55 and more Source cves: CVE-2016-10027 Source advisory:...

Exploit for Improper Restriction of XML External Entity Reference in Hazelcast

CVE-2022-0265 把 ysoser...

Vulnerability found in Atlassian Confluence Datacenter

A vulnerability has been found in Atlassian Confluence Datacenter. An unauthenticated malicious party could potentially exploit the vulnerability potentially exploit it to execute arbitrary code. Confluence Datacenter systems are only vulnerable when using the cluster functionality. Confluence...

Confluence Data Center - Java Deserialization Vulnerability In Hazelcast - CVE-2016-10750

h3. Vulnerability Details Confluence Data Center uses the third-party software Hazelcast, which is vulnerable to Java deserialization attacks CVE-2016-10750|https://vulners.com/cve/CVE-2016-10750. Hazelcast provides functionality needed to run Confluence Data Center as a cluster. A remote,...