SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Confluence Data Center and Server

This High severity org.springframework:spring-web Dependency vulnerability was introduced in versions 1.0 of Confluence Data Center and Server. This org.springframework:spring-web Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N...

Injection com.fasterxml.jackson.core:jackson-databind Dependency in Crowd Data Center and Server

This High severity com.fasterxml.jackson.core:jackson-databind Dependency vulnerability was introduced in versions 5.0.0, 5.1.0, and 5.2.0 of Crowd Data Center and Server. This com.fasterxml.jackson.core:jackson-databind Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)

Impact An attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket. netresearch/jsonmapper allows objects to be hydrated from scalar types in JSON. However, due to the lack of validation in the code for this feature, it may output improperly initialized objects if applied to...

Atlassian Confluence 6.10.x < 7.19.18 / 7.20.x < 8.5.5 / 8.6.x < 8.7.2 / 8.8.0 (CONFSERVER-94109)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-94109 advisory. - This High severity org.apache.tomcat:tomcat-catalina Dependency vulnerability was introduced in versions 6.10.0 of Confluence Data Center and...

CVE-2024-22233 CVE-2024-22233: Spring Framework server Web DoS Vulnerability

In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring MVC Spring Security 6.1....

DoS (Denial of Service) org.apache.avro:avro Dependency in Confluence Data Center and Server

This High severity org.apache.avro:avro Dependency vulnerability was introduced in versions 4.1 of Confluence Data Center and Server. This org.apache.avro:avro Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

DoS (Denial of Service) org.xerial.snappy:snappy-java Dependency in Bitbucket Data Center and Server

This High severity org.xerial.snappy:snappy-java Dependency vulnerability was introduced in versions 7.21.0, 8.9.0, 8.10.0, 8.11.0, 8.12.0, 8.13.0, 8.14.0, 8.15.0, and 8.16.0 of Bitbucket Data Center and Server. This org.xerial.snappy:snappy-java Dependency vulnerability, with a CVSS Score of 7.5...

@affinidi/common-check-widget (=1.5.1), @deep-foundation/deepcase-app (>=0.1.0-beta.20 <=0.1.0-beta.41) +30 more potentially affected by CVE-2023-46234 via browserify-sign (>=2.6.0 <=4.0.4)

browserify-sign NPM version =2.6.0, =0.1.0-beta.20, =1.4.811, =1.1.3, =1.1.1, =1.3.0-15, =3.3.0, =0.1.1, =3.7.0, =0.0.1, =0.0.8 and more Source cves: CVE-2023-46234 Source advisory: OSV:GHSA-X9W5-V3Q2-3RHW...

CVE-2023-45311

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project that depends on fsevents distributes code that was obtained from that URL at a time when it was controlled by an...

acuity (=6.18.0), acuitypro (=6.18.0) +60 more potentially affected by CVE-2022-35937 via tensorflow (>=2.8.0 <=2.8.0rc1)

tensorflow PYPI version =2.8.0, =1.2.8, =1.0.43, =0.2.2, =0.0.1, =0.0.2, =0.2.8, =0.14.0, =0.1.3, =0.0.9, =0.2.27, =0.2.41 - complaintclassify =0.0.5 - conversational-sentence-encoder =0.0.6 and more Source cves: CVE-2022-35937 Source advisory: OSV:GHSA-PXRW-J2FV-HX3H...

Malicious code in dependency123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 327dcfe6d0167239e0fe708c0d5472bb7d8b5b6b2e6aff2e3fdb2834a88ab597 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE: Security Advisory (SUSE-SU-2021:3255-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

alphapulldown (>=0.21.2 <=0.22.3), analytics-lib (>=0.0.1 <=0.0.2) +52 more potentially affected by CVE-2021-37685 via tensorflow (=2.5.0)

tensorflow PYPI version =2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - alphapulldown =0.21.2, =0.0.1, =1.1.0, =0.8.1, =3.3.0, =0.0.24, =1.0.0, =2.0.2, =0.6.0, =0.7.0, =1.4.0 - fancyimpute =0.6.0 and more Source...

accuinsight (>=1.0.62 <=3.0.0rc2), adapt-diagnostics (>=1.2.0 <=1.6.0) +110 more potentially affected by CVE-2021-29580 via tensorflow (>=2.3.0 <=2.3.2)

tensorflow PYPI version =2.3.0, =1.0.62, =1.2.0, =0.1.0, =0.0.1a0, =0.0.1, =1.0.0rc1, =20210206.0.0, =0.1.0.dev1, =0.2.4, =1.0.1.0, =1.0.3 - cardec-cite =1.1.0 and more Source cves: CVE-2021-29580 Source advisory: OSV:GHSA-X8H6-XGQX-JQGP...

pycnet-audio (>=0.5.1 <=0.5.8) potentially affected by CVE-2021-29571 via tensorflow-cpu (=2.2.0)

tensorflow-cpu PYPI version =2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - pycnet-audio =0.5.1, =0.5.8 Source cves: CVE-2021-29571 Source advisory: OSV:GHSA-WHR9-VFH2-7HM6...

c4v-py (>=0.1.0.dev1 <=0.1.0.dev202107081840) potentially affected by CVE-2021-29595 via tensorflow-cpu (=2.3.1)

tensorflow-cpu PYPI version =2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - c4v-py =0.1.0.dev1, =0.1.0.dev202107081840 Source cves: CVE-2021-29595 Source advisory: OSV:PYSEC-2021-523...

0.workspace (>=0.1.0 <=0.1.1), 18a58t9c-upload (>=1.0.0 <=1.0.3) +17847 more potentially affected by CVE-2020-28472 via aws-sdk (>=2.0.0-rc1 <=2.813.0)

aws-sdk NPM version =2.0.0-rc1, =0.1.0, =1.0.0, =0.21.0, =1.0.0, =1.0.0, =0.1.0, =3.6.0, =0.0.2, =0.3.0, =0.1.0, =0.5.0 and more Source cves: CVE-2020-28472 Source advisory: SNYK:JS-AWSSDK-1059424...

CVE-2019-11405

CVE-2019-11405 affects OpenAPI Tools OpenAPI Generator prior to 4.0.0-20190419.052012-560. The described vulnerability arises because the project uses http:// URLs in build.gradle, build.gradle.mustache, and build.sbt files, enabling insecurely resolved dependencies. This exposes potential Man-in...

am.ik.beansviz:beansviz-spring-boot-actuator (=0.1.0), com.baulsupp:oksocial (>=1.20.0 <=1.47.0-dirty) +81 more potentially affected by CVE-2017-5617 via com.kitfox.svg:svg-salamander (=1.0)

com.kitfox.svg:svg-salamander MAVEN version =1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.kitfox.svg:svg-salamander and may be impacted: - am.ik.beansviz:beansviz-spring-boot-actuator =0.1.0 - com.baulsupp:oksocial =1.20.0, =1.0.0, =2017.2.1...