Security Bulletin: IBM Common Licensing is vulnerable by a remote code attack in Spring Framework and Apache Commons(CVE-2022-22970,CVE-2022-22971,CVE-2022-33980)

Summary IBM Common Licensing is vulnerable to a remote code execution in Spring Framework CVE-2022-22970,CVE-2022-22971 as it does have Spring Framework versions 5.3.0 to 5.3.20, 5.2.0 to 5.2.22, and older versions. IBM Common Licensing is vulnerable to a remote code execution in Apache Commons...

apache-commons-configuration:YAMLConfigurationReadFuzzer: Uncaught exception in java.base/java.util.regex.Pattern$GroupHead.match

Detailed Report: https://oss-fuzz.com/testcase?key=5022621716054016 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationReadFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

apache-commons-jxpath:JXPathFuzzer: Uncaught exception in java.base/java.lang.StringBuffer.append

Detailed Report: https://oss-fuzz.com/testcase?key=5062161688297472 Project: apache-commons-jxpath Fuzzing Engine: libFuzzer Fuzz Target: JXPathFuzzer Job Type: libfuzzerasanapache-commons-jxpath Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Liberty profile shipped with IBM Robotic Process Automation

Summary WebSphere Application Server Liberty profile is shipped as a component of IBM Robotic Process Automation. Information about security vulnerabilities affecting IBM WebSphere Application Server Liberty profile have been published in a security bulletin. Vulnerability Details...

apache-commons-configuration:XMLConfigurationLoadFuzzer: Uncaught exception in java.xml/com.sun.org.apache.xalan.internal.xsltc.trax.DOM2TO.parse

Detailed Report: https://oss-fuzz.com/testcase?key=5063421489446912 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: XMLConfigurationLoadFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

apache-commons-configuration:YAMLConfigurationWriteFuzzer: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeMappingChildren

Detailed Report: https://oss-fuzz.com/testcase?key=5790977205338112 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationWriteFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

apache-commons-compress: excessive memory allocation when reading a specially crafted ZIP archive

A flaw was found in apache-commons-compress. When reading a specially crafted ZIP archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This flaw allows the mounting of a denial of service attack against services that use Compress' zip...

apache-commons-compress: infinite loop when reading a specially crafted 7Z archive

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This flaw allows the mounting of a denial of service attack against services that use Compress' SevenZ package...

apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for very small inputs. This flaw allows the mounting of a denial of service attack against services that use Compress' Seven...

Apache Commons Configuration Code Execution

The vulnerability of the Apache Commons Configuration library is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially crafted script, DNS, and URL requests...

PT-2022-19694

exploit 1. CVE-2022-33980: Apache Commons Configuration-RCE https://github.com/tangxiaofeng7/CVE-2022-33980-Apache-Commons-Configuration-RCE 2. CVE-2022-29554: Mishandling of Input to API in PrintixService.exe https://github.com/ComparedArray/printix-CVE-2022-29554...

CVE-2022-33980

A flaw was found in Apache Commons Configuration's variable interpolation, which by default included several lookup actions that could permit script invocation on remote servers. This issue could allow an attacker to use one of these actions to send a request to execute arbitrary code on the serv...

Important: Red Hat Security Advisory: Red Hat Fuse 7.11.0 release and security update

A minor version update from 7.10 to 7.11 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scorin...

apache-commons-compress: infinite loop when reading a specially crafted 7Z archive

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This flaw allows the mounting of a denial of service attack against services that use Compress' SevenZ package...

apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for very small inputs. This flaw allows the mounting of a denial of service attack against services that use Compress' Seven...

apache-commons-compress: excessive memory allocation when reading a specially crafted ZIP archive

A flaw was found in apache-commons-compress. When reading a specially crafted ZIP archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This flaw allows the mounting of a denial of service attack against services that use Compress' zip...

apache-commons-compress: excessive memory allocation when reading a specially crafted TAR archive

A flaw was found in apache-commons-compress. When reading a specially crafted TAR archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This flaw allows the mounting of a denial of service attack against services that use Compress' TAR...

GHSA-XJ57-8QJ4-C4M6 Code injection in Apache Commons Configuration

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "$prefix:name", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the...

Code injection in Apache Commons Configuration

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "$prefix:name", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the...

Apache Commons remote code execution vulnerability

Apache Commons is a project of the Apache Software Foundation. Apache Commons is vulnerable to a remote code execution vulnerability that could be exploited by attackers to execute malicious code via injection attacks, write webshells to websites, and take control of entire websites or even serve...