CVE-2021-4104

CVE-2021-4104 affects JMSAppender in Log4j 1.2 when it is explicitly configured to use JMSAppender. A deserialization of untrusted data can occur if an attacker can write Log4j configuration and supply TopicBindingName and TopicConnectionFactoryBindingName, causing JMSAppender to perform JNDI req...

CVE-2021-37714

CVE-2021-37714 affects jsoup (Java HTML parser) versions prior to 1.14.2. When parsing untrusted HTML/XML, the parser may loop, slow down, or throw exceptions, enabling a denial-of-service condition. A fix is available in jsoup 1.14.2. Workarounds include rate-limiting parsing input, capping inpu...

CVE-2021-34429

Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5, and 11.0.1-11.0.5 are vulnerable to a security bypass where specially crafted URIs using encoded characters allow unauthorized access to the WEB-INF directory or other security constraints. This is a variation of CVE-2021-28164. Impact includes...