CVE-2021-29425

CVE-2021-29425 affects Apache Commons IO up to version 2.6, specifically FileNameUtils.normalize. With inputs such as "//../foo" or "\..\foo", normalization can yield a value that does not escape to higher directories, potentially enabling access to the parent directory if the resulting path is u...

CVE-2021-36374

CVE-2021-36374 affects Apache Ant and causes denial of service via memory allocation when parsing specially crafted ZIP-based archives (and derived formats such as JARs and certain Office files). The vulnerability stems from how Ant reads these archives, enabling large memory use and out-of-memor...

CVE-2020-1945

This CVE (CVE-2020-1945) affects Apache Ant. Connected Arch Linux advisory ASA-202005-15 confirms the vulnerability exists in ant before version 1.10.8-1, where Ant uses java.io.tmpdir for several tasks and can leak sensitive information. The fixcrlf and replaceregexp tasks may copy files from th...

CVE-2021-36373

CVE-2021-36373 is a denial-of-service in Apache Ant caused by reading a specially crafted TAR archive that can exhaust memory, leading to OOM during builds. The initial description notes that Ant versions affected include 1.9.16 and 1.10.11 and that a memory exhaustion can disrupt builds. Connect...

CVE-2019-0227

The CVE-2019-0227 entry concerns an SSRF in Apache Axis 1.4 (last released in 2006). The connected IBM bulletins confirm Axis 1.x vulnerability details and state Axis 2 is the successor, with 1.7.9 (Axis2) being not vulnerable. Affected Axis 1.x components are legacy; remediation is to upgrade to...

CVE-2018-8032

CVE-2018-8032 affects Apache Axis 1.x (up to 1.4) with a cross-site scripting (XSS) vulnerability in the default servlet/services. This vulnerability is documented in IBM/PM security bulletins linked to Axis, confirming an XSS flaw (CWE-79) in Axis 1.x and indicating broader IBM product exposure....

CVE-2025-30729

The CVE-2025-30729 vulnerability affects Oracle Communications Order and Service Management (OC OSM) in Oracle Communications Applications, specifically versions 7.4.0–7.5.0. An attacker with network access via HTTP and low privileges can exploit it, with user interaction required, to cause unaut...

CVE-2025-21554

CVE-2025-21554 affects Oracle Communications Order and Service Management (OCS/M) Security component. Affected versions are 7.4.0, 7.4.1 and 7.5.0. According to sources, an unauthenticated attacker with network access over HTTP can read a subset of data from Oracle Communications Order and Servic...

CVE-2018-2567

CVE-2018-2567 affects Oracle Communications Order and Service Management (Portal subcomponent). The vulnerability exists in supported versions 7.2.4.1.x, 7.2.4.2.x, 7.3.0.x.x and 7.3.0.1.x. According to the sources, an unauthenticated attacker with network access via HTTP can compromise the syste...

CVE-2023-22088

CVE-2023-22088 affects Oracle Communications Order and Service Management (OCS) User Management in versions 7.4.0 and 7.4.1. The vulnerability arises from insufficient input validation in the User Management component, allowing a low-privilege, unauthenticated attacker with network access via HTT...

CVE-2018-2756

CVE-2018-2756 affects Oracle Communications Order and Service Management (WebUI) in Oracle Communications Applications. A vulnerability in the WebUI subcomponent impacts supported versions 7.2.4.3.0, 7.3.0.1.x, 7.3.1.0.7 and 7.3.5.0.x. It allows a low-privileged attacker with network access via H...

CVE-2025-21542

CVE-2025-21542 affects Oracle Communications Order and Service Management (OC OSM) in versions 7.4.0, 7.4.1 and 7.5.0. The issue is described as an access control weakness in the Security component that, with network access over HTTP and using low privileges, allows unauthorized update/insert/del...

CVE-2025-21544

Oracle Communications Order and Service Management (part of Oracle Communications Applications) is affected in versions 7.4.0–7.5.0. The issue arises from improper permission handling/storage in the component, enabling a low-privileged, network-accessing attacker (HTTP) to modify or read accessib...