Denial Of Service (DoS)

commons-fileupload is vulnerable to denial of service attacks. The vulnerability can be triggered because the HTTP server does not properly filter the file upload requests which has the size of MIME boundary close to the size of the buffer in MultipartStream...

Arbitrary Code Execution

Apache commons-collections is vulnerable to arbitrary code execution. It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code wi...

Arbitrary File Write With Null Byte In File Name

The DiskFileItem class in Apache Commons FileUpload allows remote attackers to write to arbitrary files via a NULL byte in a file name when it is deserialized. This vulnerability first requires the application using this library to be deserializing untrusted data...

Man In The Middle (MitM) Attacks Are Possible With Spoofed SSL Servers

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via...

Denial Of Service (DoS)

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service infinite loop and CPU consumption via a crafted Content-Type header that bypasses a loop's intended exit conditions...

Apache Tomcat 7.0.0 < 7.0.70

The version of Tomcat installed on the remote host is prior to 7.0.70. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.70security-7 advisory. - The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70...

VulnCheck KEV: CVE-2018-1273

Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution...

MGASA-2019-0001 Updated pache-commons-compress packages fix security vulnerabilities

A flaw was found in Apache Commons Compress versions 1.11 to 1.15. A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount ...

Updated pache-commons-compress packages fix security vulnerabilities

A flaw was found in Apache Commons Compress versions 1.11 to 1.15. A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount ...

Security Bulletin: IBM Content Navigator is affected by a vulnerability in Apache Apache Commons BeanUtils (CVE-2014-0114)

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An attack...

GHSA-QQV6-5W6P-3PGR Moderate severity vulnerability that affects org.hswebframework.web:hsweb-commons

An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java...

Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons

A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...

Fedora 29 : apache-commons-compress (2018-1b7b0ad759)

Fix for CVE-2018-11771 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenab...

Fedora 28 : apache-commons-compress (2018-d29be920dc)

Fix for CVE-2018-11771 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenab...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +8420 more potentially affected by CVE-2016-1000031 via commons-fileupload:commons-fileupload (>=1.0 <=1.3.2)

commons-fileupload:commons-fileupload MAVEN version =1.0, =1.1, =0.0.1, =1.0, =1.0.1.RELEASE, =4.0, =4.0, =4.0, =4.2 and more Source cves: CVE-2016-1000031 Source advisory: OSV:GHSA-7X9J-7223-RG5M...

GHSA-7X9J-7223-RG5M Improper Access Control in commons-fileupload

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +5777 more potentially affected by CVE-2014-0050 via commons-fileupload:commons-fileupload (>=1.0 <=1.3.1-jenkins-2)

commons-fileupload:commons-fileupload MAVEN version =1.0, =1.1, =0.0.1, =1.0, =1.0, =3.1.1, =0.0.1, =0.3.15 and more Source cves: CVE-2014-0050 Source advisory: OSV:GHSA-XX68-JFCG-XMMF...

GHSA-XX68-JFCG-XMMF Commons FileUpload Denial of service vulnerability

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service infinite loop and CPU consumption via a crafted Content-Type header that bypasses a loop's intended exit conditions...

Commons FileUpload Denial of service vulnerability

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service infinite loop and CPU consumption via a crafted Content-Type header that bypasses a loop's intended exit conditions...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +7889 more potentially affected by CVE-2016-3092 via commons-fileupload:commons-fileupload (>=1.0 <=1.3.1)

commons-fileupload:commons-fileupload MAVEN version =1.0, =1.1, =0.0.1, =1.0, =4.0, =4.0, =4.0, =4.0, =4.2 and more Source cves: CVE-2016-3092 Source advisory: OSV:GHSA-FVM3-CFVJ-GXQQ...