CVE-2022-36799: Improper Control of Generation of Code

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Templat...

Atlassian Jira和Atlassian JIRA Data Center 代码注入漏洞

Atlassian Jira and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian Jira is a defect tracking management system. The system is used to track and manage all types of issues and defects on the job.Atlassian JIRA Data Center is the data center version of Atlassian JIRA. ...

Security Bulletin: Multiple vulnerabilites affect IBM Engineering Test Management product due to XStream

Summary IBM Engineering Test Management is vulnerable to arbitrary code execution due to XStream. CVE-2021-21342, CVE-2021-21350, CVE-2021-21346, CVE-2021-21349, CVE-2021-21341, CVE-2021-21345, CVE-2021-21348, CVE-2021-21344, CVE-2021-21347, CVE-2021-21343, CVE-2021-21351 Vulnerability Details...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.7 security update

Red Hat Integration Camel Extensions for Quarkus 2.7 is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Moderate. A Common Vulnerability Scoring System CVSS base score, whic...

xstream: Injecting highly recursive collections or maps can cause a DoS

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulatin...

xstream: Injecting highly recursive collections or maps can cause a DoS

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulatin...

Important: Red Hat Security Advisory: Red Hat Fuse 7.11.0 release and security update

A minor version update from 7.10 to 7.11 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scorin...

XStream: remote command execution attack by manipulating the processed input stream

A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Security Bulletin: IBM Engineering Test Management is vulnerable to arbitrary data access due to XStream ( CVE-2020-26258, CVE-2020-26259 )

Summary IBM Engineering Test Management is vulnerable to remote attacker having access to snesitive data or to arbitrary files from system due to XStream. Vulnerability Details CVEID: CVE-2020-26258 DESCRIPTION: XStream is vulnerable to server-side request forgery, caused by a flaw when...

Security Bulletin: IBM Engineering Test Management is vulnerable to execute arbitrary commands on system due to XStream ( CVE-2021-29505 ).

Summary IBM Engineering Test Management is vulnerable to remote attacker to execute arbitrary commands on the system, caused by improper input validation. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system...

Security Bulletin: Vulnerabilities in Samba, OpenSSL, Python, and XStream affect IBM Spectrum Protect Plus (CVE-2021-20254, CVE-2021-3712, CVE-2021-43859, CVE-2022-0778, CVE-2020-25717, CVE-2021-23192, CVE-2021-3733)

Summary Vulnerabilities in Samba, OpenSSL, Python, and XStream may affect IBM Spectrum Protect Plus. These vulnerabilities include bypassing security restrictions, obtaining sensitive information, denial of service, and elevation of privileges. Vulnerability Details CVEID: CVE-2021-20254...

xstream:XmlFuzzer: Uncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=5910875522859008 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

Security Bulletin: Vulnerabilities in Golang Go, OpenSSL, Python, and XStream affect IBM Spectrum Copy Data Management

Summary Vulnerabilities in Golang Go, OpenSSL, Python, and XStream, such as bypassing security restrictions and denial of service, may affect IBM Spectrum Copy Data Management. Vulnerability Details CVEID:CVE-2021-44716 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an...

xstream:XmlFuzzer: Uncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=5496762753744896 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

xstream:XmlFuzzer: Uncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=6605769950232576 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

xstream:XmlFuzzer: Uncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=5672341444624384 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

xstream:XmlFuzzer: Uncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

Detailed Report: https://oss-fuzz.com/testcase?key=5875660188418048 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: com.ctc.wstx.dtd.FullDTDReader.readContentSpec...

Vulnerabilities fixed in IBM Spectrum Control

IBM has fixed multiple vulnerabilities in supporting software provided with IBM Spectrum Control, The vulnerabilities are in XStream, Apache Xerces2, Jackson, OpenSSL, and Java SE. The vulnerabilities allow a malicious party to perform attacks execute attacks that result in the following categori...

Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to XStream, Apache Xerces2, Jackson, OpenSSL, and Java SE

Summary Vulnerabilities in XStream, Apache Xerces2, Jackson, OpenSSL, and Java SE such as execution of arbitrary code, denial of service, server-side request forgery, amd weaker than expected security may affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2021-4160 DESCRIPTION: OpenSSL...

xstream:XmlFuzzer: Uncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=4917343177801728 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...