org.keycloak:keycloak-dependencies-server-all (3.2.0.cr1), org.keycloak:keycloak-saml-adapter-api-public (3.2.0.cr1) +26 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (3.2.0.cr1)

org.keycloak:keycloak-saml-core MAVEN version 3.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 3.2.0.cr1 -...

org.keycloak:keycloak-saml-adapter-api-public (4.6.0.final), org.keycloak:keycloak-saml-adapter-core (4.6.0.final) +25 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (4.6.0.final)

org.keycloak:keycloak-saml-core MAVEN version 4.6.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-saml-adapter-api-public 4.6.0.final -...

Exploit for Path Traversal in Wso2 Api_Manager

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit and writeup...

Spring Framework readRemoteInvocation RCE

The vulnerability of the readRemoteInvocation method implemented by the HTTP-request handler based on the Servlet-API HttpInvokerServiceExporter in the Spring Framework software platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious...

Oracle Configurator UI Servlet Data Access

The vulnerability of the UI Servlet component of the Oracle Configurator relates to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain access to read, modify, add, or delete data using the HTTP protocol over the network...

Jetty Improper Authentication Confidential Data

The vulnerability of Jetty servlet containers is related to improper authentication. Exploiting this vulnerability allows a malicious actor to gain access to confidential data...

Spring Framework RCE, Early Announcement

Updates 04-13 "Data Binding Rules Vulnerability CVE-2022-22968" follow-up blog post published, related to the "disallowedFields" from the Suggested Workarounds 04-08 Snyk announces an additional attack vector for Glassfish and Payara. See also related Payara, upcoming release announcement 04-04...

DWSurvey 代码问题漏洞

DWSurvey is a survey system written in Java. DWSurvey v3.2.0 has a security vulnerability that allows an attacker to write arbitrary files via the component /utils/ToHtmlServlet.java...

CVE-2021-42854

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's DSA PluginServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/plugin/pmx" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be...

Aternity SteelCentral AppInternals 路径遍历漏洞

Aternity SteelCentral AppInternals is a monitoring modern automation solution from Aternity, Inc. It provides application performance monitoring APM and diagnostics. Aternity SteelCentral AppInternals Dynamic Sampling Agent DSA A security vulnerability exists in the AgentConfigurationServlet that...

CVE-2022-24252

An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file...

CVE-2022-24252

An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file...

PT-2022-16565

Name of the Vulnerable Software and Affected Versions Extensis Portfolio version 4.0 Description The issue is related to an unrestricted file upload vulnerability in the FileTransferServlet component, allowing remote attackers to execute arbitrary code via a crafted file. Recommendations For...

PT-2022-3872 · Atlassian · Crowd +6

Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo versions prior to 8.0.9 Atlassian Bamboo versions 8.1.0 through 8.1.8 Atlassian Bamboo versions 8.2.0 through 8.2.4 Atlassian Bitbucket versions prior to 7.6.16 Atlassian Bitbucket versions 7.7.0 through 7.17.8 Atlassian...

PT-2022-4931 · Atlassian · Crowd +6

Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo versions 8.0.0 through 8.0.8 Atlassian Bamboo versions 8.1.0 through 8.1.7 Atlassian Bamboo versions 8.2.0 through 8.2.3 Atlassian Bitbucket versions 7.0.0 through 7.6.15 Atlassian Bitbucket versions 7.7.0 through 7.17.7...

CVE-2021-44550

An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java lines 158 and 159...

Stanford CoreNlp 注入漏洞

Stanford CoreNlp is a suite of open source, natural language analysis tools written in Java by the Stanford Nlp Group team. CoreNLP 4.3.2 suffers from an injection vulnerability that originates in classifier in NERServlet.java...

CVE-2021-42854

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's DSA PluginServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/plugin/pmx" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be...

CVE-2021-42853

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's DSA AgentDiagnosticServlet has directory traversal vulnerability at the "/api/appInternals/1.0/agent/diagnostic/logs" API. The affected endpoint does not have any input validation of the user's input that allows a...

Low: Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 14 Security Update

An update is now available for Red Hat JBoss Web Server 3.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this release as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...