apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

A flaw was found in apache-avro. When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints, leading to an out-of-memory error and a denial of service on the system...

iText Input Validation Error Vulnerability

iText is an open source library for creating and manipulating PDF files in Java. It is written by Bruno Lowagie, Paulo Soares and others. An input validation error vulnerability exists in Apryse iText version 8.0.2, which stems from a problem in the main function of the PdfDocument.java file,...

DEBIAN-CVE-2023-44483

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

The vulnerability of the hasNextChunk function in the snappy-java compression/decompression library allows a hacker to cause a service failure.

The vulnerability of the hasNextChunk function in the snappy-java compression/decompression library is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the compress(char[] input) function in the snappy-java compression/decompression library, which allows a hacker to cause a service failure.

The vulnerability of the compresschar input function in the snappy-java compression/decompression library is related to integer overflow. Exploiting this vulnerability could allow an attacker to cause a service failure remotely...

The vulnerability of the Java library for analyzing, extracting, and managing data in HTML documents, jsoup, is related to deficiencies in handling exceptional states, allowing attackers to trigger a service failure.

The vulnerability of the Java library for analyzing, extracting, and managing data in HTML documents, known as jsoup, is related to deficiencies in handling exceptional states. Exploiting this vulnerability can allow an attacker to cause service interruptions...

CVE-2023-20965

In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Exploit for CVE-2022-33980

riskootext4shell text4shell script for text coomons =1.10...

dev-java/snakeyaml: DoS via stack overflow

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack...

Important: xstream

Issue Overview: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new...

PortEx - Java Library To Analyse Portable Executable Files With A Special Focus On Malware Analysis And PE Malformation Robustness

PortEx is a Java library for static malware analysis of Portable Executable files. Its focus is on PE malformation robustness, and anomaly detection. PortEx is written in Java and Scala, and targeted at Java applications. Features Reading header information from: MSDOS Header, COFF File Header,...

CVE-2022-37936

Unauthenticated Java deserialization vulnerability in Serviceguard Manager...

CVE-2023-25158

GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore...

CVE-2023-25158 Unfiltered SQL Injection in Geotools

GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore...

CVE-2023-25158 Unfiltered SQL Injection in Geotools

GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore...

CVE-2023-25158

CVE-2023-25158 is a CVSS 9.8 Critical SQL injection in GeoTools (open-source Java geospatial library) affecting OGC Filter execution against JDBCDataStore implementations. The root cause is direct concatenation of filter parameters into SQL without sanitization. Affected vectors include PropertyI...

CVE-2023-25158: Improper Neutralization of Special Elements used in an SQL Command

GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore...

dd-plist 代码问题漏洞

dd-plist is a Java library for working with attribute lists from the individual developer Daniel Dreibrodt. A code issue vulnerability exists in dd-plist version 1.17, which stems from the presence of an xml external entity reference vulnerability...

SUSE CVE-2015-7940

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman ECDH key exchanges, aka an "invalid curve attack."...

SUSE CVE-2021-21348

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup...