Security Bulletin: The version of IBM WebSphere Liberty shipped with IBM MQ is vulnerable to multiple CVEs (CVE-2021-29842,CVE-2021-33517, CVE-2021-36090)

Summary The version of IBM WebSphere Liberty Profile that is shipped with IBM MQ is vulnerable to Information Disclosure. IBM WebSphere Liberty Profile is used to provide WebUI and REST API capabilities. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerabl...

be.personify.iam:personify-api (>=1.2.6.RELEASE <=1.3.1.RELEASE), be.personify.iam:personify-frontend (>=1.2.6.RELEASE <=1.3.0.RELEASE) +58 more potentially affected by CVE-2021-22047 via org.springframework.data:spring-data-rest-core (>=3.5.0 <=3.5.5)

org.springframework.data:spring-data-rest-core MAVEN version =3.5.0, =1.2.6.RELEASE, =1.2.6.RELEASE, =1.2.5.RELEASE, =5.12.1, =5.12.0, =5.12.0, =5.12.0, =5.12.0, =2.1.0, =2.1.0, =2.1.0, =2.1.2 and more Source cves: CVE-2021-22047 Source advisory: OSV:GHSA-4926-QPXG-6R3W...

GHSA-CVCF-W75C-GW5R Mulesoft Mule Unsafe Deserialization

The MuleSoft Mule runtime engine before 3.8.0 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections...

Mulesoft Mule Unsafe Deserialization

The MuleSoft Mule runtime engine before 3.8.0 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections...

new packages: xml-commons-resolver

An update is available for xml-commons-resolver. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Roc...

new packages: xml-commons-apis

An update is available for xml-commons-apis. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

new packages: apache-commons-net

An update is available for apache-commons-net. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

new packages: apache-commons-logging

An update is available for apache-commons-logging. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the...

new packages: apache-commons-lang3

An update is available for apache-commons-lang3. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Roc...

new packages: apache-commons-io

An update is available for apache-commons-io. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

new packages: apache-commons-codec

An update is available for apache-commons-codec. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Roc...

new packages: apache-commons-cli

An update is available for apache-commons-cli. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

GHSA-33RH-5HVF-5JJP ZF-Commons ZfcUser Vulnerable to XSS in Login Redirect

Cross-site scripting XSS vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

ZF-Commons ZfcUser Vulnerable to XSS in Login Redirect

Cross-site scripting XSS vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

org.apache.portals.jetspeed-2:app-servers (>=2.1.3 <=2.1.4), org.apache.portals.jetspeed-2:applications (>=2.1.3 <=2.1.4) +35 more potentially affected by CVE-2016-0711 via org.apache.portals.jetspeed-2:jetspeed-commons (>=2.1.3 <=2.3.0)

org.apache.portals.jetspeed-2:jetspeed-commons MAVEN version =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.2.1, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.1.3, =2.3.0 and more Source cves: CVE-2016-0711 Source advisory: OSV:GHSA-5PGM-9G57-3WC7...

at.researchstudio.sat:won-owner-webapp (=0.3), at.researchstudio.sat:won-utils-mail (>=0.2 <=0.9) +1394 more potentially affected by CVE-2017-9801 via org.apache.commons:commons-email (>=1.1 <=1.4)

org.apache.commons:commons-email MAVEN version =1.1, =0.2, =1.0.0, =1.2.8, =1.0.2, =1.2, =1.0.0, =1.0.1, =0.0.1, =2.23.0, =1.1, =1.4 and more Source cves: CVE-2017-9801 Source advisory: OSV:GHSA-P7VM-PHXX-G722...

GHSA-P7VM-PHXX-G722 Improper Input Validation in Apache Commons Email

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers...

Improper Input Validation in Apache Commons Email

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers...

com.canoo:webtest (>=586 <=1393), com.flexiblewebsolutions.xdriveunit:xdriveunit (=0.3) +79 more potentially affected by CVE-2017-12621 via commons-jelly:commons-jelly (>=1.0 <=1.0-beta-4)

commons-jelly:commons-jelly MAVEN version =1.0, =586, =0.1, =1.0, =20050708.205531, =1.2, =1.0-M5, =1.0.1, =1.3, =1.9 - jepi:jepi =1.0 - marmalade:marmalade-compat-jelly =1.0-alpha-3 - maven-plugins:maven-sourceforge-plugin =1.3 and more Source cves: CVE-2017-12621 Source advisory:...

Improper Restriction of XML External Entity Reference in Jelly

During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...