Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to an unspecified vulnerability in Java SE ( CVE-2022-21341)

Summary An unspecified vulnerability in Java SE - CVE-2022-21341 related to the Serialization component has been identified that affects IBM Watson Assistant for IBM Cloud Pak for Data. Java SE is used by IBM Watson Assistant for IBM Cloud Pak for Data as part of its platform for developement of...

[SECURITY] Fedora 36 Update: golang-github-googleapis-gnostic-0.5.3-5.fc36

This package contains a Go command line tool which converts JSON and YAML OpenAPI descriptions to and from equivalent Protocol Buffer representations. Protocol Buffers provide a language-neutral, platform-neutral, extensible mechanism for serializing structured data. gnostic's Protocol Buffer...

Symfony collectionCascaded and collectionCascadedDeeply fields security bypass

When using the Validator component, if Symfony\Component\Validator\Mapping\Cache\ApcCache is enabled or any other cache implementing Symfony\Component\Validator\Mapping\Cache\CacheInterface, some information is lost during serialization the collectionCascaded and the...

GHSA-Q8J7-FJH7-25V5 Symfony collectionCascaded and collectionCascadedDeeply fields security bypass

When using the Validator component, if Symfony\Component\Validator\Mapping\Cache\ApcCache is enabled or any other cache implementing Symfony\Component\Validator\Mapping\Cache\CacheInterface, some information is lost during serialization the collectionCascaded and the...

Denial Of Service (DoS)

Gson is vulnerable to denial of service. The vulnerability exists in internal java classes due to not preventing writing a replacement JDK object during serialization which allows an attacker to cause an application crash...

IBM Java 6.0 < 6.0.16.25 / 6.1 < 6.1.8.25 / 7.0 < 7.0.9.40 / 7.1 < 7.1.3.40 / 8.0 < 8.0.3.0 Multiple Vulnerabilities (Apr 19, 2016)

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.25 / 6.1 6.1.8.25 / 7.0 7.0.9.40 / 7.1 7.1.3.40 / 8.0 8.0.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle April 19 2016 CPU advisory. - Unspecified vulnerability in Oracle Java SE...

IBM Java 7.0 < 7.0.10.70 / 7.1 < 7.1.4.70 / 8.0 < 8.0.6.15 Multiple Vulnerabilities (Jan 14, 2020)

The version of IBM Java installed on the remote host is prior to 7.0 7.0.10.70 / 7.1 7.1.4.70 / 8.0 8.0.6.15. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle January 14 2020 CPU advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE...

IBM Java 7.0 < 7.0.10.65 / 7.1 < 7.1.4.65 / 8.0 < 8.0.6.25 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 7.0 7.0.10.65 / 7.1 7.1.4.65 / 8.0 8.0.6.25. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle April 14 2020 CPU advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE...

IBM Java 6.0 < 6.0.16.55 / 6.1 < 6.1.8.55 / 7.0 < 7.0.15.5 / 7.1 < 7.1.5.5 / 8.0 < 8.0.5.5 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.55 / 6.1 6.1.8.55 / 7.0 7.0.15.5 / 7.1 7.1.5.5 / 8.0 8.0.5.5. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle October 17 2017 CPU advisory. - inffast.c in zlib 1.2.8 might allow...

[SECURITY] Fedora 34 Update: golang-github-googleapis-gnostic-0.5.3-5.fc34

This package contains a Go command line tool which converts JSON and YAML OpenAPI descriptions to and from equivalent Protocol Buffer representations. Protocol Buffers provide a language-neutral, platform-neutral, extensible mechanism for serializing structured data. gnostic's Protocol Buffer...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Java

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Java. Vulnerability Details CVEID: CVE-2022-21365 DESCRIPTION: An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service...

Design/Logic Flaw

Discourse Assign is a plugin for assigning users to a topic in Discourse, an open-source messaging platform. Prior to version 1.0.1, the UserBookmarkSerializer serialized the whole User / Group object, which leaked some private information. The data was only being serialized to people who could...

CVE-2022-24866 Exposure of Sensitive Information to an Unauthorized Actor in Discourse Assign

Discourse Assign is a plugin for assigning users to a topic in Discourse, an open-source messaging platform. Prior to version 1.0.1, the UserBookmarkSerializer serialized the whole User / Group object, which leaked some private information. The data was only being serialized to people who could...

EulerOS 2.0 SP8 : java-1.8.0-openjdk (EulerOS-SA-2022-1571)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported...

PT-2022-29264

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.4 Description The issue concerns the serialization of indirect PHY register access in the Realtek rtl8365mb driver. It was introduced in version v5.16 and fixed in version v5.17.4. The actual impact and...

Arbitrary Code Execution in Cookie Serialization

The default serialization used by Plug session may result in code execution in certain situations. Keep in mind, however, the session cookie is signed and this attack can only be exploited if the attacker has access to your secret key as well as your signing/encryption salts. We recommend users t...

GHSA-5V4M-C73V-C7GQ Arbitrary Code Execution in Cookie Serialization

The default serialization used by Plug session may result in code execution in certain situations. Keep in mind, however, the session cookie is signed and this attack can only be exploited if the attacker has access to your secret key as well as your signing/encryption salts. We recommend users t...

fastjson2:JsonFuzzer: Uncaught exception in com.alibaba.fastjson.serializer.SerialContext.toString

Detailed Report: https://oss-fuzz.com/testcase?key=5706188777455616 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

PT-2025-8471

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue in the Linux kernel has been identified where the input dev can be unregistered while calling snd jack report when using ASoC, leading to a NULL pointer dereference. This occurs...

Oracle Java SE Serialization Component Data Compromise

The vulnerability of the Serialization component in the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker to compromise the integrity of data...