OSV-2023-518 Security exception in com.code_intelligence.jazzer.sanitizers.XPathInjection.checkXpathExecute

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60148 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.XPathInjection.checkXpathExecute org.hamcrest.xml.HasXPath.compiledXPath org.hamcrest.xml.HasXPath...

PT-2023-35887 · Oracle · Java.Base

Name of the Vulnerable Software and Affected Versions: java.base affected versions not specified Description: A security exception occurs due to a crash in the checkSsrf and checkSsrfSocket functions within the ServerSideRequestForgery class. This issue is related to the java.net.Socket.connect...

PT-2023-35886 · Unknown · Com.Code Intelligence.Jazzer.Sanitizers.Xpathinjection +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A security exception crash was reported, involving the checkXpathExecute function from com.code intelligence.jazzer.sanitizers.XPathInjection, and the...

OSV-2023-517 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60112 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal java.base/sun.reflect.generics.reflectiveObjects.TypeVariableImpl.hashCode java.base/java.util.Arrays.hashCode...

PT-2023-35834 · Apache · Apache Lucene

Name of the Vulnerable Software and Affected Versions: Apache Lucene affected versions not specified Description: A security exception crash has been reported in Apache Lucene. The crash occurs in the org.apache.lucene.util.ArrayUtil.growExact function, which is called by...

OSV-2023-396 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58938 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal java.base/java.util.Arrays.hashCode java.base/sun.reflect.generics.reflectiveObjects.ParameterizedTypeImpl.hashC...

PT-2023-35827 · Spring +1 · Org.Springframework.Expression +1

Name of the Vulnerable Software and Affected Versions: No specific software or version information is provided in the input descriptions. Description: The issue is related to a security exception, with details provided in an OSS-Fuzz report. The crash state involves several Java functions,...

OSV-2023-383 Security exception in org.json.JSONStringer.value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58722 Crash type: Security exception Crash state: org.json.JSONStringer.value org.json.JSONArray.writeTo org.json.JSONStringer.beforeValue...

OSV-2023-214 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57295 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal java.base/java.util.HashMap.get org.springframework.core.convert.TypeDescriptor.valueOf...

OSV-2023-116 Security exception in org.codehaus.janino.Parser.parseUnaryExpression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56367 Crash type: Security exception Crash state: org.codehaus.janino.Parser.parseUnaryExpression java.base/java.nio.ByteBuffer.limit java.base/java.nio.Buffer...

OSV-2023-60 Security exception in org.json.JSONTokener.nextValue

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55978 Crash type: Security exception Crash state: org.json.JSONTokener.nextValue org.json.JSONTokener.readArray org.json.JSONTokener.nextToInternal...

CVE-2022-45419

If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted. This vulnerability...

Code injection

If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted. This vulnerability...

CVE-2022-45419

CVE-2022-45419 describes a Firefox trust-management vulnerability where, if a user added a security exception for an invalid TLS certificate, kept an ongoing TLS connection, and then deleted the exception, Firefox could keep the connection alive and continue to treat the certificate as trusted. A...

OSV-2022-1243 Security exception in com.github.javaparser.CommentsInserter.insertComments

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53980 Crash type: Security exception Crash state: com.github.javaparser.CommentsInserter.insertComments java.base/java.util.Objects.equals com.github.javaparser.Position.equals...

OSV-2022-1224 Security exception in com.fasterxml.jackson.databind.jsontype.impl.AsArrayTypeDeserializer.deserialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53822 Crash type: Security exception Crash state: com.fasterxml.jackson.databind.jsontype.impl.AsArrayTypeDeserializer.deserialize com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializerNR.deserialize...

OSV-2022-1217 Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53767 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.RegexInjection.hookInternal com.codeintelligence.jazzer.sanitizers.RegexInjection.patternHook...

PT-2022-36794 · Git +1 · Hamcrest

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A security exception crash was reported, involving the com.code intelligence.jazzer.sanitizers.RegexInjection class and its methods hookInternal and...

OSV-2022-1207 Security exception in java.desktop/java.awt.image.DataBufferInt.<init>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53708 Crash type: Security exception Crash state: java.desktop/java.awt.image.DataBufferInt. java.desktop/java.awt.image.Raster.createPackedRaster org.apache.commons.imaging.formats.jpeg.decoder.JpegDecoder.visitSOS...

OSV-2022-1196 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53627 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/java.lang.Module.canRead java.base/sun.invoke.util.VerifyAccess.isModuleAccessible...