87 matches found
OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...
OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization (Libraries, 8270392)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability...
CVE-2022-21365
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allow...
KLA12392 RCE vulnerability in Microsoft Azure
Remote code execution vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2021-44228 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware is...
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2
Published on: 2021 Dec 11, updated 2022 Apr 6. SUMMARY Microsoft continues our analysis of the remote code execution vulnerabilities related to Apache Log4j a logging tool used in many Java-based applications disclosed on 9 Dec 2021. Currently, Microsoft is not aware of any impact, outside of the...
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2
Published on: 2021 Dec 11, updated 2022 Apr 6. SUMMARY SUMMARY Microsoft continues our analysis of the remote code execution vulnerabilities related to Apache Log4j a logging tool used in many Java-based applications disclosed on 9 Dec 2021. Currently, Microsoft is not aware of any impact, outsid...
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2
Published on: 2021 Dec 11, updated 2021 Dec 18. SUMMARY Microsoft continues our analysis of the remote code execution vulnerabilities related to Apache Log4j a logging tool used in many Java-based applications disclosed on 9 Dec 2021. Currently, Microsoft is not aware of any impact, outside of th...
Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software included in Rational Developer for i
Summary Vulnerabilities detected in Node.js versions before v14.16.2 that affect the Cordova platform packaged with Rational Developer for i Software. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...
CVE-2021-39177
Summary: CVE-2021-39177 affects Geyser versions prior to 1.4.2-SNAPSHOT, where an attacker who can connect to a server can forge a LoginPacket with a manipulated JWT token to impersonate any user. The issue is mitigated by upgrading to 1.4.2-SNAPSHOT or later, which includes a patch. Other workar...
Github Geyser授权问题漏洞
Github Geyser is Geyser is the bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition, bridging the gap between those who want to play truly cross-platform. Geyser 1.4.2-SNAPSHOT Previous versions of Geyser 1.4.2-SNAPSHOT had an authorization issue vulnerability that stemmed from...
CVE-2021-2341
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows...
Minecraft Java Edition vulnerable to directory traversal
Overview Minecraft Java Edition provided by Mojang Studios contains a directory traversal vulnerability CWE-22. RyotaK reported this vulnerability to the developer and coordinated on his own. After coordination was completed, this case was reported to IPA, and JPCERT/CC coordinated with the...
The vulnerability in the IBM SDK Java Technology Edition development tools relates to the use of an unreliable search path, allowing a perpetrator to execute arbitrary code.
The vulnerability of the IBM SDK Java Technology Edition development tools is related to the use of an unreliable search path. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Security Bulletin: Windows DLL injection vulnerability in IBM Java Runtime affects Collaboration and Deployment Services
Summary There is a Windows DLL injection vulnerability in IBM® Runtime Environment Java™ Version JRE71SR4FP15, JRE71SR4FP45 and JRE8SR5FP36 used by Collaboration and Deployment Services on windows platform. This issue was disclosed as part of the IBM Java SDK updates in January 2020. Vulnerabilit...
Code Execution Vulnerability in IBM SDK Java Technology Edition
IBM SDK, Java Technology Edition is a software development kit for Java application development from IBM, USA. A security vulnerability exists in IBM SDK Java Technology Edition versions 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0. A local attacker could explo...
CVE-2019-4732
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing ...
The vulnerability of the Scripting component in Oracle Java SE and Java SE Embedded software platforms allows attackers to compromise the integrity of protected information or cause partial service interruptions.
The vulnerability of the Scripting component in Oracle Java SE and Java SE Embedded software-related programs is related to an exception handling error. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information or cause partial service...
Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jul 2018 - Includes Oracle Jul 2018 CPU affects DB2 Recovery Expert for Linux, Unix and Windows
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6, Version 7 ,version 8, that is used by DB2 Recovery Expert for Linux, Unix and Windows. These issues were disclosed as part of the IBM Java SDK updates in July 2018. Vulnerability Details CVEID: CVE-2016-07...
The vulnerability of the RMI component in Oracle Java SE and Java SE Embedded software platforms allows attackers to gain access to modify, add, or delete data.
The vulnerability of the RMI component in Oracle Java SE and Java SE Embedded software platforms is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain access to modify, add, or delete data remotely...
