Eclipse Jetty Cross-Site Scripting Vulnerability (CNVD-2019-42375)

Eclipse Jetty is the Eclipse Foundation of an open source , Java-based Web server and Java Servlet container . A cross-site scripting vulnerability exists in the Cookie Dump Servlet in Eclipse Jetty versions prior to 6.1.22. The vulnerability stems from a lack of proper validation of client-side...

Eclipse Jetty Cross-Site Scripting Vulnerability (CNVD-2019-42378)

Eclipse Jetty is the Eclipse Foundation of an open source , Java-based Web server and Java Servlet container . A cross-site scripting vulnerability exists in the JSP Dump and Session Dump Servlets in Eclipse Jetty versions prior to 6.1.22. The vulnerability stems from a lack of proper validation ...

Eclipse Jetty Cross-Site Scripting Vulnerability

Eclipse Jetty is the Eclipse Foundation of an open source , Java-based Web server and Java Servlet container . A cross-site scripting vulnerability exists in the WebApp JSP Snoop page in EEclipse Jetty 6.1.21 and earlier versions. The vulnerability stems from a lack of proper validation of...

Eclipse Jetty Information Disclosure Vulnerability

Eclipse Jetty is the Eclipse Foundation of an open source , Java-based Web server and Java Servlet container . An information disclosure vulnerability exists in Dump Servlet in Eclipse Jetty versions prior to 6.1.22. The vulnerability stems from errors such as configuration during operation of a...

Security Bulletin: Multiple vulnerabilities in Java affect IBM Spectrum Protect Plus

Summary Multiple vulnerabilities in Java were disclosed as part of the Java SDK updates in January 2019 that affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2018-1890 DESCRIPTION: IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may...

Security Bulletin: Security vulnerabilities in IBM Java Runtime affect IBM License Key Server Administration and Reporting Tool and Agent

Summary There are multiple vulnerabilities related to IBM® Runtime Environment Java™ Technology Edition which is used and shipped by different versions of IBM License Key Server Administration and Reporting Tool ART and Agent. Vulnerability Details CVEID: CVE-2019-4473 DESCRIPTION: Multiple...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MessageGateway

Summary There are multiple vulnerabilities in IBM Runtime Environment Java Version 8.0 used by IBM MessageGateway These issues were disclosed as part of the IBM Java SDK updates in July 2019. Vulnerability Details CVEID: CVE-2019-11775 DESCRIPTION: All builds of Eclipse OpenJ9 prior to 0.15 conta...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Content Classification

Summary There are multiple vulnerabilities in IBM® SDK Java Technology Edition, Version 6 and IBM® Runtime Environment Java Version 7 used by IBM Content Classification. These issues were disclosed as part of the IBM Java SDK updates in Jul 2019. Vulnerability Details CVEID: CVE-2019-11775...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Tivoli Netcool/OMNIbus (CVE-2019-4473, CVE-2019-11771)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by Tivoli Netcool/OMNIbus. These were disclosed as part of the IBM Java SDK update in July 2019. Vulnerability Details CVEID: CVE-2019-4473 DESCRIPTION: Multiple binaries in IBM...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, 7.0.10.35 used by IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise has addressed the applicable CVEs. These issues were also addressed by IBM...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Content Collector for SAP Applications

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Java™ Version 7 and Java™ Version 8 that is used by IBM Content Collector for SAP Applications. These issues were disclosed as part of the IBM Java SDK updates in Jul 2019. Vulnerability Details CVEID: CVE-2019-11772...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this...

Unspecified Vulnerability in Eclipse OpenJ9

Eclipse OpenJ9 is a Java application engine of the Eclipse Foundation . A security vulnerability exists in the Eclipse OpenJ9 Access Diagnostics feature, which can be exploited by an attacker to submit a request to bypass security checks to create a file, among other actions...

CVE-2019-17631

From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks...

CVE-2019-17631

From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks...

Privilege escalation

From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks...

CVE-2019-17631

From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks...

CVE-2019-17631

CVE-2019-17631 : Eclipse OpenJ9 could allow a local attacker to gain elevated privileges due to a missing authorization check when accessing a resource or action. In IBM docs, affected product Liberty for Java is listed (version 3.37); remediation is to upgrade to Liberty for Java v3.40-20200108-...

Eclipse Paho Java client library input validation error vulnerability

Eclipse Paho Java client library is the Eclipse Foundation of a use of the Java language written in MQTT Message Queuing Telemetry Transport client library . An input validation error vulnerability exists in the Eclipse Paho Java client library version 1.2.0. The vulnerability originates from a...

CVE-2019-10245

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load...