CXF: Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior ...

PT-2025-41048

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc1-roce-flush+ 25 Description The Linux kernel contains a flaw in the RDMA/rxe subsystem related to double freeing of memory associated with memory registration mr-map. Specifically, the rxe mr cleanup...

Metabase input validation error vulnerability

Metabase is an open source data analytics platform from the US-based Metabase, Inc. A security vulnerability exists in Metabase that stems from a custom GeoJSON map URL address that will follow a redirect to an address that is otherwise not allowed, such as a link to a local or private network...

CVE-2022-39359

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions...

CVE-2022-39359: Exposure of Sensitive Information to an Unauthorized Actor

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions...

PT-2022-24927 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 Description: The issue concerns Metabase, a data visualization software. In affected versions, a custom GeoJSON map URL address would follow redirec...

CVE-2022-38200

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser...

CVE-2022-38200

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser...

Cross site scripting

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser...

Esri Arcgis Server cross-site scripting vulnerability

Esri Arcgis Server is a Web-oriented, enterprise-class software platform for delivering geolocation services from Environmental Systems Research Institute Esri. A security vulnerability exists in Esri Arcgis Server versions 10.8.1 and 10.7.1, which stems from a cross-site scripting vulnerability ...

CVE-2022-38200: Improper Neutralization of Input During Web Page Generation

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser...

net.praqma:memory-map (>=2.2.0, <=2.2.1), org.jenkins-ci.plugins.workflow:workflow-aggregator (2.4) +1 more potentially affected by CVE-2022-43409 via org.jenkins-ci.plugins.workflow:workflow-support (2.5)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version 2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-support and may be impacted: - net.praqma:memory-map =2.2.0, =1.0.0, =1.0.1 Source cves:...

com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2), de.taimos:pipeline-aws (>=1.0, <=1.13) +5 more potentially affected by CVE-2022-43401 +3 more via org.jenkins-ci.plugins.workflow:workflow-cps (2.21)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - com.logmein:pipeline-bamboo =0.0.1, =1.0, =y, =2.2.0, =1.0, =0.6, =0.6,...

io.jenkins.blueocean:blueocean (>=1.0.0-b15, <=1.0.0-b21), io.jenkins.blueocean:blueocean-github-pipeline (>=1.0.0-b15, <=1.0.0-b21) +7 more potentially affected by CVE-2022-43406 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.3)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b15,...

GSD-2022-1006582 net/smc: Stop the CLC flow if no link to map buffers on

net/smc: Stop the CLC flow if no link to map buffers on This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.146 by commit...

GSD-2022-1006555 net/smc: Stop the CLC flow if no link to map buffers on

net/smc: Stop the CLC flow if no link to map buffers on This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.71 by commit...

GSD-2022-1006515 net/smc: Stop the CLC flow if no link to map buffers on

net/smc: Stop the CLC flow if no link to map buffers on This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.12 by commit...

GSD-2022-1006471 net/smc: Stop the CLC flow if no link to map buffers on

net/smc: Stop the CLC flow if no link to map buffers on This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0 by commit...

PT-2022-5267

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free memory flaw was found in the Linux kernel, specifically in the Intel GVT-g graphics driver, which triggers VGA card system resource overload. This issue could allow a local...

OESA-2022-1957 log4j security update

Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fixes: It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Contex...