com.distelli.graphql:graphql-apigen (>=2.2.0, <=2.3.0), com.distelli.graphql:graphql-apigen-deps (>=2.2.0, <=2.3.0) +4 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (2.4.0)

com.graphql-java:graphql-java MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.distelli.graphql:graphql-apigen =2.2.0, =2.2.0, =2.1.1, =3.0.4, =3.0.4, =3.2.0 Source cves:...

com.graphql-java:graphql-java-servlet (>=5.0.0, <=5.0.1), com.graphql-java:graphql-java-tools (>=5.0.0, <=5.2.3) +51 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (8.0)

com.graphql-java:graphql-java MAVEN version 8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.graphql-java:graphql-java-servlet =5.0.0, =5.0.0, =4.1.0, =4.1.0, =1.5.18, =1.5.18, =1.5.13, =1.5.1...

Apache JSPWiki cross-site scripting vulnerabilities

Apache JSPWiki is an open source WikiWiki engine built on Java, Servlet and JSP from the Apache Foundation. security vulnerability exists in versions prior to Apache JSPWiki 2.11.3, which stems from a carefully crafted request on the WeblogPlugin that could trigger an XSS vulnerability, which cou...

[SECURITY] [DSA 5198-1] jetty9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5198-1 [email protected] https://www.debian.org/security/ Markus Koschany August 02, 2022 https://www.debian.org/security/faq -...

GHSA-JMVV-524F-HJ5J Improper Handling of Exceptional Conditions in Apache Tomcat

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the origin...

DEBIAN-CVE-2022-22970

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object...

Apache Tomcat AJP Connector Information Leak

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when...

Debian: Security Advisory (DSA-4949-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2661-1] jetty9 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2661-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler May 14, 2021 https://wiki.debian.org/LTS -...

CentOS: Security Advisory for tomcat (CESA-2020:5020)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

tomcat security update

CentOS Errata and Security Advisory CESA-2020:5020 An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

Low: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CVE-2020-27978

Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in the Java Servlet container session...

CVE-2020-27978: Allocation of Resources Without Limits or Throttling

Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in the Java Servlet container session...

Design/Logic Flaw

An AEM java servlet in AEM versions 6.5.5.0 and below and 6.4.8.1 and below executes with the permissions of a high privileged service user. If exploited, this could lead to read-only access to sensitive data in an AEM repository...

CVE-2020-9733

CVE-2020-9733 affects Adobe Experience Manager (AEM) Java servlet on AEM 6.5.5.0 and earlier and 6.4.8.1 and earlier, which can run with the permissions of a high-privileged service user and may lead to read-only access to sensitive data in the AEM repository. The issue is mitigated by applying p...

CVE-2020-9733: Exposure of Sensitive Information to an Unauthorized Actor

An AEM java servlet in AEM versions 6.5.5.0 and below and 6.4.8.1 and below executes with the permissions of a high privileged service user. If exploited, this could lead to read-only access to sensitive data in an AEM repository...

PT-2020-5112

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions prior to 6.5.5.0 Adobe Experience Manager versions prior to 6.4.8.1 Description The issue is related to an AEM java servlet that executes with the permissions of a high privileged service user, potentially...

CVE-2020-24786

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build numbe...

CVE-2020-24786

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build numbe...