Hutool Security Vulnerabilities

Hutool is a small but comprehensive Java tools library from the Chinese Dromara community. A security vulnerability exists in hutool version v5.8.21, which stems from a buffer overflow vulnerability in the component jsonArray...

CVE-2023-42277

hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath...

CVE-2023-42276

CVE-2023-42276 (hutool v5.8.21) : A buffer overflow in the jsonArray component has been reported. The NVD entry documents a 3.1 CVSS base score of 9.8 (CRITICAL) with NETWORK attack vector, low complexity, no user interaction, and impact to confidentiality, integrity, and availability (all HIGH)....

CVE-2023-42277

CVE-2023-42277 affects Hutool library v5.8.21, with a buffer overflow in the component jsonObject.putByPath. Multiple connected sources describe this as a boundary/array-check issue contributing to a critical buffer overflow (CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The documentation does ...

CVE-2023-42278

hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse...

CVE-2023-42278

CVE-2023-42278 affects Hutool 5.8.21 and is a buffer overflow in the JSONUtil.parse() component. The CVE entry is corroborated by multiple sources (NVD entry lists a high impact with network access, no user interaction, and availability impact; related advisories reference the same JSONUtil.parse...

Hutool Security Vulnerabilities

Hutool is a small but complete Java tool library from the Chinese Dromara community. A security vulnerability exists in Hutool version v5.8.21, which stems from a buffer overflow vulnerability in the component JSONUtil.parse...

CVE-2023-42278

hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse...

Security Bulletin: Multiple vulnerabilities found on thirdparty libraries used by IBM® MobileFirst Platform

Summary There are multiple vulnerabilities in open source libraries used by IBM MobileFirst Platform Foundation. They are addressed in this update. Vulnerability Details CVEID:CVE-2022-45688 DESCRIPTION: Hutool is vulnerable to a denial of service, caused by stack-based buffer overflow. By...

Security Bulletin: IBM Cognos Analytics is affected but not classified as vulnerable to multiple vulnerabilities

Summary IBM Cognos Analytics is affected but not classified as vulnerable to vulnerabilities, based on current information, in the following 3rd-party components: Stanford coreNLP, FasterXML jackson-databind, SnakeYAML, Dromera Hutool, jsoup, Node.js vm2 and Node.js http-cache-semantics. These...

XML External Entity (XXE) Injection

cn.hutool:hutool-all and cn.hutool:hutool-core are vulnerable to XML external entitiy XXE injection attacks. The vulnerability exists in readBySax function of XmlUtil.java due to the use of SAXParserFactory which allows an attacker to parse malicious DTDs as a result of an incorrectly configured...

ai.foxpay.api:foxpay-sdk (>=1.0 <=1.1), ai.genauth:genauth-java-sdk (=3.1.11) +2100 more potentially affected by CVE-2023-3276 via cn.hutool:hutool-core (>=4.0.0 <=5.8.19)

cn.hutool:hutool-core MAVEN version =4.0.0, =1.0, =j8.2.2.0, =j8.2.2.0, =Finchley.SR2.SR1, =Finchley.SR4, =j8.2.2.0, =Finchley.SR2.SR1, =Finchley.SR2.SR1, =Finchley.SR4, =j8.2.2.0, =j8.2.2.0, =1.0.2, =1.0.4 and more Source cves: CVE-2023-3276 Source advisory: OSV:GHSA-P2QF-9VP6-3JJQ...

HuTool XML parsing module has blind XXE vulnerability

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference...

GHSA-P2QF-9VP6-3JJQ HuTool XML parsing module has blind XXE vulnerability

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference...

CVE-2023-3276

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclos...

CVE-2023-3276

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclos...

Xxe

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclos...

CVE-2023-3276 Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity reference

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclos...

CVE-2023-3276

HuTool (Dromara HuTool) up to 5.8.19 contains an XXE flaw in XmlUtil.readBySax, enabling xml external entity reference exploitation. Publicly disclosed exploit; no fixed version information in the provided documents. Affected component: XML Parsing Module (XmlUtil.java). Practical impact describe...

Dromara HuTool 代码问题漏洞

Hutool is a small but comprehensive library of Java tools for the Chinese Dromara community. A code issue vulnerability exists in Dromara HuTool versions prior to 5.8.19. An attacker could exploit this vulnerability to perform an xml external entity reference attack...