apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

Critical: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.11. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

Security Bulletin: IBM InfoSphere Information Server is affected by a remote code execution vulnerability in Apache Commons Text (CVE-2022-42889)

Summary A remote code execution vulnerability in Apache Commons Text used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2022-42889 DESCRIPTION: Apache Commons Text could allow a remote attacker to execute arbitrary code on the system, caused by an insecure...

Security Bulletin: Denial of Service vulnerability in Apache commons-fileupload may affect IBM Business Automation Workflow (CVE-2023-24998)

Summary IBM Business Automation Workflow packages a vulnerable copy of Apache commons-fileupload in its /BPM/Lombardi/lib directory. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number o...

GHSA-8J28-34QQ-GMCH Apache Sling Commons JSON bundle vulnerable to Improper Input Validation

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The org.apache.sling.commons.json bundle has been...

Input validation

UNSUPPORTED WHEN ASSIGNED Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. NOTE: This vulnerability only affects products that are no longer supported by the maintainer The...

PT-2023-15535 · Apache · Apache Sling Commons Json

Name of the Vulnerable Software and Affected Versions: Apache Sling Commons JSON bundle affected versions not specified Description: The issue is related to improper input validation, allowing an attacker to trigger unexpected errors by supplying specially-crafted input. The...

Apache Sling 输入验证错误漏洞

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to comply with JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. An input validation error vulnerability exists in Apache Sling Commons...

Malicious code in hyrule-react-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3b82bec5139c178e3b425e5e458a9c7b248b17db5192cf6178702cbb26822dba The OpenSSF Package Analysis project identified 'hyrule-react-commons' @ 2.0.1 npm as malicious. It is considered malicious because: - The packa...

MAL-2023-1204 Malicious code in hyrule-react-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3b82bec5139c178e3b425e5e458a9c7b248b17db5192cf6178702cbb26822dba The OpenSSF Package Analysis project identified 'hyrule-react-commons' @ 2.0.1 npm as malicious. It is considered malicious because: - The packa...

Security Bulletin: Multiple Security Vulnerabilities have been fixed in IBM Security Verify Access

Summary Multiple Security Vulnerabilities have been fixed in IBM Security Verify Access 10.0.5.0 IF1. Instructions on obtaining the fix are below. Vulnerability Details CVEID:CVE-2023-25927 DESCRIPTION: IBM Security Verify Access could allow an attacker to crash the webseald process using special...

Cross-Site Scripting (XSS)

org.xwiki.commons:xwiki-commons-xml is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape arbitrary HTML code before it output to the front end, allowing an attacker to inject and execute malicious javascript on the victim's browser...

Security Bulletin: Denial of Service in Apache Commons used by WebSphere Application Server affect IBM Operations Analytics - Log Analysis (CVE-2023-24998)

Summary There is a vulnerability in the Apache Commons FileUpload library used by IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request...

GHSA-PV7V-PH6G-3GXV Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml

Impact The HTML sanitizer, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This can be exploited, e.g., via the link syntax in any content that supports XWiki syntax like comments in XWiki:...

PT-2023-8607 · Xwiki · Xwiki-Commons-Xml

Name of the Vulnerable Software and Affected Versions: org.xwiki.commons:xwiki-commons-xml versions 14.6-rc-1 through 14.10.3 org.xwiki.commons:xwiki-commons-xml versions prior to 15.0 RC1 Description: The HTML sanitizer in the org.xwiki.commons:xwiki-commons-xml library allows the injection of...

Security Bulletin: Security Vulnerabilities in IBM WebSphere Liberty and xml2js affect IBM Voice Gateway

Summary Security Vulnerabilities in IBM WebSphere Liberty and xml2js affect IBM Voice Gateway Vulnerability Details CVEID:CVE-2023-0842 DESCRIPTION: xml2js could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution. By sending a specially-crafted reques...

Security Bulletin: Vulnerability in Apache Commons Compress affects IBM Process Mining . CVE-2021-35515, CVE-2021-35516 + CVE-2021-35517

Summary There is a vulnerability in Apache Commons Compress that could allow a remote authenticated attacker to execute denial of service on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...

Security Bulletin: Vulnerability in Apache Commons Compress affects IBM Process Mining . CVE-2021-36090

Summary There is a vulnerability in Apache Commons Compress that could allow a remote authenticated attacker to execute denial of service on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...

Security Bulletin: CVE-2023-24998 may affect IBM CICS TX Advanced

Summary CVE-2023-24998 may affect IBM WebSphere Application Server Liberty supplied with IBM CICS TX Advanced. IBM CICS TX Advanced has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service,...