Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.11 and earlier

Summary This fix upgrades to grpc 1.55.1, jersey 2.39.1, jackson 2.15.2, and socket.io 4.6.2. Vulnerability Details CVEID:CVE-2023-31125 DESCRIPTION: Engine.IO is vulnerable to a denial of service, caused by an uncaught exception. By sending a specially crafted HTTP request, a remote authenticate...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to information disclosure vulnerability due to org.glassfish.jersey.core_jersey-common (CVE-2021-28168)

Summary IBM Sterling Partner Engagement Manager has addressed vulnerability mentioned in CVE by updating to latest versions of libraries. Vulnerability Details CVEID:CVE-2021-28168 DESCRIPTION: Eclipse Jersey could allow a local attacker to obtain sensitive information, caused by use of the...

newjerseyonlinetrafficschool.com Cross Site Scripting vulnerability OBB-3267864

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

njsexualmedicine.com Cross Site Scripting vulnerability OBB-3221784

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

New Attack Technique Makes It Easy to Identify Web Users

By Deeba Ahmed This attack can work on any major browser, including the anonymity-centric Tor. The New Jersey Institute of Technology… This is a post from HackRead.com Read the original post: New Attack Technique Makes It Easy to Identify Web Users...

br.com.digisan:digisan-java (>=1.0.7 <=1.0.10), com.adaptrex:adaptrex-complete (>=0.9.1 <=0.9.10) +810 more potentially affected by CVE-2014-3643 via com.sun.jersey:jersey-core (>=0.9-ea <=1.12-b01)

com.sun.jersey:jersey-core MAVEN version =0.9-ea, =1.0.7, =0.9.1, =0.1.1, =0.9.1, =v0.27.12, =2.0.4, =1.0.2, =1.0.2, =1.0.1-3, =2.0, =2.0, =1.1.0.1, =1.1.0.1, =4.2.0, =4.2.0, =5.4.3 and more Source cves: CVE-2014-3643 Source advisory: OSV:GHSA-5M48-VR54-VMH3...

br.com.digisan:digisan-java (>=1.0.7 <=1.0.10), com.adaptrex:adaptrex-complete (>=0.9.1 <=0.9.10) +810 more potentially affected by CVE-2014-3643 via com.sun.jersey:jersey-core (>=1.0 <=1.12-b01)

com.sun.jersey:jersey-core MAVEN version =1.0, =1.0.7, =0.9.1, =0.1.1, =0.9.1, =v0.27.12, =2.0.4, =1.0.2, =1.0.2, =1.0.1-3, =2.0, =2.0, =1.1.0.1, =1.1.0.1, =4.2.0, =4.2.0, =5.4.3 and more Source cves: CVE-2014-3643 Source advisory: SNYK:JAVA-COMSUNJERSEY-10441493...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the SAX parse. An attacker can access sensitive information by submitting XML input referencing external entities. Details XXE Injection is a type of attack against an application that parses XML...

jersey: XXE via parameter entities

jersey: XXE via parameter entities not disabled by the jersey SAX parser...

GHSA-5M48-VR54-VMH3 jersey: XXE via parameter entities

jersey: XXE via parameter entities not disabled by the jersey SAX parser...

com.sun.jersey.contribs:jersey-lift (>=1.1.1-ea <=1.1.5-ea-v20091019), com.sun.jersey.contribs:jersey-lift-test (>=1.1.1-ea <=1.1.5-ea-v20091019) +29 more potentially affected by CVE-2013-3300 via net.liftweb:lift-webkit (>=2.0 <=2.0-RC2)

net.liftweb:lift-webkit MAVEN version =2.0, =1.1.1-ea, =1.1.1-ea, =2.0-M1, =2.0, =2.0, =2.0-RC2 - net.liftweb:lift-flot-demo =2.0-M4 - net.liftweb:lift-hellofbc =2.0-M4 and more Source cves: CVE-2013-3300 Source advisory: OSV:GHSA-JF9V-FXFQ-WM76...

com.sun.jersey.contribs:jersey-lift (>=1.1.5 <=1.19.4), com.sun.jersey.contribs:jersey-lift-test (>=1.1.5 <=1.19.4) +22 more potentially affected by CVE-2013-3300 via net.liftweb:lift-webkit (>=1.0 <=1.1-M8)

net.liftweb:lift-webkit MAVEN version =1.0, =1.1.5, =1.1.5, =1.0, =1.0, =1.0, =1.1-M7, =1.1-M3, =1.0, =1.0, =1.0, =1.0, =1.0, =1.1-M7, =1.0, =1.1-M1, =1.1-M8 and more Source cves: CVE-2013-3300 Source advisory: OSV:GHSA-JF9V-FXFQ-WM76...

Important: Red Hat Security Advisory: Red Hat Integration Camel-K 1.6.4 release and security update

A micro version update from 1.6.3 to 1.6.4 is now available for Red Hat Integration Camel K that includes bug fixes and enhancements. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a...

jersey: Local information disclosure via system temporary directory

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are...

jersey: Local information disclosure via system temporary directory

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.2.1 security update

A security update to Red Hat Integration Camel Extensions for Quarkus 2.2 is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Moderate. A Common Vulnerability Scoring System...

com.netflix.conductor:conductor-contribs (>=0.0.4 <=1.12.13), com.netflix.conductor:conductor-es2-persistence (>=1.10.0 <=1.12.13) +5 more potentially affected by CVE-2020-9296 via com.netflix.conductor:conductor-core (>=0.0.4 <=1.9.7)

com.netflix.conductor:conductor-core MAVEN version =0.0.4, =0.0.4, =1.10.0, =1.7.7, =0.0.4, =1.8.2, =0.0.4, =1.6.0, =1.8.0-alpha-1 Source cves: CVE-2020-9296 Source advisory: OSV:GHSA-WFJ5-2MQR-7JVV...

centraljerseyankleandfoot.com Cross Site Scripting vulnerability OBB-2353642

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

jersey: Local information disclosure via system temporary directory

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are...

Moderate: Red Hat Security Advisory: Red Hat AMQ Streams 1.8.0 release and security update

Red Hat AMQ Streams 1.8.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...