Security Bulletin: Financial Transaction Manager for Corporate Payment Services v2.1.1 is affected by a validation vulnerability (CVE-2019-10086)

Summary IBM Financial Transaction Manager for Corporate Payment Services FTM CPS for Multi-Platform has addressed the following vulnerability. A potential vulnerability in the Apache Commons Beanutils module could allow unauthorized access to the classloader. Vulnerability Details CVEID:...

GHSA-J3RH-8VWQ-WH84 JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0

JHipster Kotlin is using an insecure source of randomness to generate all of its random values. JHipster Kotlin relies upon apache commons lang3 RandomStringUtils. From the documentation: Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically...

JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0

JHipster Kotlin is using an insecure source of randomness to generate all of its random values. JHipster Kotlin relies upon apache commons lang3 RandomStringUtils. From the documentation: Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically...

apache-commons-configuration: uncontrolled class instantiation when loading YAML files

A flaw was found in the Apache Commons Configuration, where it uses a third-party library to process YAML files, which by default, allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default...

RHEL 7 : candlepin and satellite (RHSA-2020:2740)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2740 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide...

apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default

A flaw was found in the Apache Commons BeanUtils, where the class property in PropertyUtilsBean is not suppressed by default. This flaw allows an attacker to access the classloader...

Important: Red Hat Security Advisory: candlepin and satellite security update

An update for candlepin and satellite is now available for Red Hat Satellite 6.5 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2015-7450)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: Apache Commons FileUpload (Publicly disclosed vulnerability) in IBM eDiscovery Manager

Summary Apache Commons FileUpload, as used in Novell NetIQ Sentinel and other products, could allow a remote attacker to execute arbitrary code on the system, caused by deserialization of untrusted data in DiskFileItem class of the FileUpload library. A remote attacker could exploit this...

Important: Red Hat Security Advisory: Red Hat Fuse 7.6.0 on EAP security update

A patch is now available for Red Hat Fuse 7.6 on EAP. The purpose of this text-only errata is to inform you about the security issue fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base scor...

apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default

A flaw was found in the Apache Commons BeanUtils, where the class property in PropertyUtilsBean is not suppressed by default. This flaw allows an attacker to access the classloader...

be.ordina:microservices-dashboard-server (=1.0.1), br.com.ingenieux:apigateway-maven-plugin (>=1.5.1 <=1.5.6) +1495 more potentially affected by CVE-2015-6420 via org.apache.commons:commons-collections4 (=4.0)

org.apache.commons:commons-collections4 MAVEN version =4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.commons:commons-collections4 and may be impacted: - be.ordina:microservices-dashboard-server =1.0.1 -...

Insecure Deserialization in Apache Commons Collection

Serialized-object interfaces in Java applications using the Apache Commons Collections ACC library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object...

GHSA-6HGM-866R-3CJV Insecure Deserialization in Apache Commons Collection

Serialized-object interfaces in Java applications using the Apache Commons Collections ACC library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +34402 more potentially affected by CVE-2019-10086 via commons-beanutils:commons-beanutils (>=1.0 <=1.9.3)

commons-beanutils:commons-beanutils MAVEN version =1.0, =1.1, =0.0.1, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.2.8 - ai.catboost:catboost-spark3.22.12 =1.2.10 and more Source cves: CVE-2019-10086 Source advisory: OSV:GHSA-6PHF-73Q6-GH87...

GHSA-6PHF-73Q6-GH87 Insecure Deserialization in Apache Commons Beanutils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean...

Insecure Deserialization in Apache Commons Beanutils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli Business Service Manager (CVE-2019-10086)

Summary IBM WebSphere Application Server is shipped as a component of IBM Tivoli Business Service Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed ...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +23015 more potentially affected by CVE-2014-0114 via commons-beanutils:commons-beanutils (>=1.8.0 <=1.9.3)

commons-beanutils:commons-beanutils MAVEN version =1.8.0, =1.1, =0.0.1, =1.0.1, =0.0.25, =0.0.25, =0.0.62, =0.0.25, =0.0.86, =0.0.8, =0.0.6, =0.1.12, =0.0.2, =0.1.6 - ai.grakn.kgms:client =1.4.3 and more Source cves: CVE-2014-0114 Source advisory: OSV:GHSA-P66X-2CV9-QQ3V...

Arbitrary code execution in Apache Commons BeanUtils

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrar...