CVE-2021-3597

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to...

br.eti.clairton:ds-test (=0.4.0), ch.inftec.ju:ju-ee (>=6.0-2 <=6.1-S-5) +103 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (>=1.0.0.Beta12 <=4.0.33.Final)

org.jboss:jboss-ejb-client MAVEN version =1.0.0.Beta12, =6.0-2, =4.1, =4.1, =1.0.1, =0.1.0, =0.1.0, =2.2, =8.0, =8.0, =0.2.4, =1.0.0.Alpha3, =0.1.0, =0.1.0, =0.12.0.Final, =1.0.0.CR2 and more Source cves: CVE-2020-14297 Source advisory: OSV:GHSA-QCCH-9268-59JW...

ae.teletronics.nlp:entityextraction (>=1.3 <=1.4), ai.stainless:grails-tika (=0.1.0) +5788 more potentially affected by CVE-2019-12415 via org.apache.poi:poi (>=3.0-FINAL <=4.1.0)

org.apache.poi:poi MAVEN version =3.0-FINAL, =1.3, =1.10.2, =1.13.0, =1.2.0, =1.0.1, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2019-12415 Source advisory: OSV:GHSA-9JWC-Q6J3-8G9G...

PT-2022-10483 · Undertow · Undertow

Name of the Vulnerable Software and Affected Versions: Undertow versions prior to 2.0.35.SP1 Undertow versions prior to 2.0.36.SP1 Undertow versions prior to 2.0.39.Final Undertow versions prior to 2.2.6.SP1 Undertow versions prior to 2.2.7.SP1 Undertow versions prior to 2.2.9.Final Description: ...

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

JBoss KeyCloak is vulnerable to soft token deletion via CSRF. This issue is fixed in Keycloak 1.0.2.Final...

at.porscheinformatik.zanata:common (>=4.7.0 <=4.7.8), at.porscheinformatik.zanata:stub-server (>=4.7.0 <=4.7.8) +337 more potentially affected by CVE-2016-6345 via org.jboss.resteasy:resteasy-client (>=3.0-beta-1 <=3.0.1.Final)

org.jboss.resteasy:resteasy-client MAVEN version =3.0-beta-1, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =1.1.11, =1.1.11, =1.3.2 and more Source cves: CVE-2016-6345 Source advisory: OSV:GHSA-VXHJ-3X7P-JXP5...

be.thematchbox:AbstractRiver (>=1.0.1 <=1.1.0), br.com.starcode.trex:t-rex (=0.7.1) +319 more potentially affected by CVE-2014-3529 via org.apache.poi:poi (>=3.0-FINAL <=3.10-beta2)

org.apache.poi:poi MAVEN version =3.0-FINAL, =1.0.1, =1.0.4, =5.0.1.1, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.6.4 and more Source cves: CVE-2014-3529 Source advisory: OSV:GHSA-Q56H-JJJ6-52MF...

GHSA-XVV8-8WH9-9FH2 Keycloak Authentication Error

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks...

africa.absa:inception-application (>=1.0.0 <=1.2.0), ai.agentican:agentican-framework-core (>=0.1.0-alpha.2 <=0.1.0-alpha.4) +37936 more potentially affected by CVE-2022-24823 via io.netty:netty-codec-http (>=4.0.0.Alpha1 <=4.1.76.Final)

io.netty:netty-codec-http MAVEN version =4.0.0.Alpha1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0, =0.28.0 and more Source cves:...

CVE-2022-24823

Netty is an open-source, asynchronous event-driven network application framework. The package io.netty:netty-codec-http prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local syst...

com.bbossgroups.pdp:bboss-pdp-adminservice (>=5.0.1.1 <=5.2.0), com.bbossgroups.pdp:bboss-pdp-fastwx (=5.0.1.2) +77 more potentially affected by CVE-2012-0213 via org.apache.poi:poi-scratchpad (>=3.0.1-FINAL <=3.10-FINAL)

org.apache.poi:poi-scratchpad MAVEN version =3.0.1-FINAL, =5.0.1.1, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.6.4 and more Source cves: CVE-2012-0213 Source advisory: OSV:GHSA-JQX5-H2HW-5Q4F...

The vulnerability of the information system openSIS, related to the failure to protect the SQL query structure, allows a perpetrator to execute arbitrary SQL queries.

The vulnerability of the information system openSIS is related to the failure to implement measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries through the /opensis/modules/grades/InputFinalGrades.php parameter...

undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability...

Security Bulletin: IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is vulnerable to HTTP request smuggling due to Netty (CVE-2021-43797)

Summary Netty CVE-2021-43797 is used by IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library as part of the webhook integration. The latest patch includes Netty 4.1.72.Final to fix the vulnerability. Vulnerability Details CVEID: CVE-2021-43797 DESCRIPTION: Netty is vulnerable to...

The vulnerability of the CMAC_Final() function in the OpenSSL library, which allows a hacker to gain access to protected information

The vulnerability of the CMACFinal function in the OpenSSL library is related to errors in encryption results. Exploiting this vulnerability can allow a remote attacker to gain access to protected information...

JFinalOA SQL注入漏洞

JFinalOA is an enterprise office system developed based on the JFinal framework.JFinalOA has a SQL injection vulnerability that can be exploited by attackers to execute arbitrary SQL statements...

PT-2022-13457 · WordPress · Church Admin

Name of the Vulnerable Software and Affected Versions: Church Admin WordPress plugin versions prior to 3.4.135 Description: The issue allows unauthenticated attackers to exploit the lack of authorization and CSRF protection in certain actions and requested files. This enables them to repeatedly...

WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.5.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Image Photo Gallery Final Tiles Grid plugin versions = 3.5.4. Solution Update the WordPress Image Photo Gallery Final Tiles Grid plugin to the latest available version at least 3.5.5...

WordPress插件Image Photo Gallery Final Tiles Grid跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blogging sites on servers with PHP and MySQL.A cross-site scripting vulnerability exists in versions of the WordPress plugin Image Photo Galle...

CVE-2022-0186

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard...