CVE-2015-9251

CVE-2015-9251 affects jQuery before 3.0.0, enabling XSS when a cross-domain Ajax request omits the dataType option and text/javascript responses are executed. Connected advisories confirm the issue and indicate an upgrade resolves it; remediation is to upgrade jQuery to a fixed version as provide...

CVE-2020-2555

CVE-2020-2555 (WebLogic/Coherence) : A deserialization vulnerability in Oracle Coherence (Fusion Middleware) enables unauthenticated remote code execution via the T3 protocol. Affected versions include Coherence 3.7.1.x, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0. The flaw originates from ReflectionExtra...

CVE-2021-45105

Summary of CVE-2021-45105 (Log4j2) : Affected Log4j 2.x versions 2.0-alpha1 through 2.16.0 (except 2.12.3 and 2.3.1) are vulnerable to denial of service via uncontrolled recursion triggered by self-referential lookups in Thread Context Map data. The root cause is improper handling of self-referen...

CVE-2019-10086

CVE-2019-10086 affects Apache Commons BeanUtils 1.9.2, where a BeanIntrospector addition could suppress access to the classloader via the class property on Java objects. The issue stems from not applying the suppression by default in PropertyUtilsBean, enabling potential risk across affected depl...

CVE-2020-36518

CVE-2020-36518 affects jackson-databind prior to 2.13.0, enabling a Java StackOverflow and DoS via excessive nesting depth. In affected advisories, remediation is to upgrade jackson-databind to 2.13.0+ (examples show 2.13.x or newer such as 2.13.4.2 in Crowd/CWD references). Practical impact is d...

CVE-2021-39144

CVE-2021-39144 refers to a remote code execution vulnerability in XStream, a Java library for XML serialization. When processed input streams are manipulated, an attacker with sufficient rights could execute arbitrary commands on the host. Public descriptions consistently note that XStream now us...

CVE-2020-25649

The CVE-2020-25649 entry concerns a flaw in FasterXML Jackson Databind where entity expansion was not properly secured, enabling XML External Entity (XXE) attacks. This is a data-integrity risk. Connected advisories consistently associate the issue with Jackson Databind and XXE, and several sourc...

CVE-2021-36374

CVE-2021-36374 affects Apache Ant and causes denial of service via memory allocation when parsing specially crafted ZIP-based archives (and derived formats such as JARs and certain Office files). The vulnerability stems from how Ant reads these archives, enabling large memory use and out-of-memor...

CVE-2020-9488

CVE-2020-9488 affects the Apache Log4j2 SMTP appender. The issue is improper validation of the SSL/TLS certificate when the host name does not match, potentially allowing a man-in-the-middle to intercept SMTPS traffic and leak log messages. The concrete remediation is to upgrade to affected relea...

CVE-2020-10683

CVE-2020-10683 is described in IBM Bulletin sources as an XXE vulnerability in the dom4j library, allowing a remote authenticated attacker to obtain sensitive information through XML processing. The issue stems from dom4j handling External DTDs/Entities by default, and multiple IBM entries map th...

CVE-2018-1000632

CVE-2018-1000632 affects dom4j prior to 2.1.1 with an XML Injection (CWE-91) in Element methods addElement/addAttribute. An attacker could tamper XML content via crafted attributes/elements. The issue is fixed in 2.1.1+, and IBM/IOC advisories indicate upgrading dom4j (e.g., to 2.1.4 in IOC) to a...

CVE-2021-31684

JSON Smart contains a denial-of-service vulnerability in the indexOf function of JSONParserByteArray, affecting versions 1.3 and 2.4. A crafted web request can trigger the issue. Public advisories note fixes in later releases (e.g., 1.3.3/2.4.5 and vendor-specific patches such as Debian 2.2-2+deb...

CVE-2020-1945

This CVE (CVE-2020-1945) affects Apache Ant. Connected Arch Linux advisory ASA-202005-15 confirms the vulnerability exists in ant before version 1.10.8-1, where Ant uses java.io.tmpdir for several tasks and can leak sensitive information. The fixcrlf and replaceregexp tasks may copy files from th...

CVE-2021-39139

CVE-2021-39139 affects XStream, a Java XML serialization library. The vulnerability allows a remote attacker to load and execute arbitrary code by manipulating the processed input stream; exploitation depends on the affected XStream version and runtime behavior. Connected advisories confirm XStre...

CVE-2021-27568

CVE-2021-27568 affects Netplex json-smart-v1 and json-smart-v2 (NumberFormatException uncaught), leading to potential denial of service or exposure of sensitive information when unhandled exceptions occur in the library. Connected IBM advisories confirm the vulnerability in IBM DOORS-related prod...

CVE-2020-28052

CVE-2020-28052 — BC Java OpenBSDBCrypt.password check issue : In Legion of the Bouncy Castle BC Java versions 1.65 and 1.66, the OpenBSDBCrypt.checkPassword method can compare data incorrectly during password verification, causing some incorrect passwords to be treated as a match for different, p...

CVE-2021-39152

CVE-2021-39152 concerns the XStream Java XML serialization library. The vulnerability allows a remote attacker to request data from internal resources not publicly available by manipulating the processed input stream, impacting systems using affected XStream versions when running Java runtimes ar...

CVE-2021-39151

CVE-2021-39151 is part of a family of vulnerabilities in XStream, a Java library used for XML serialization. The connected documents confirm that, in affected versions, an attacker can load and execute arbitrary code on a remote host by manipulating the processed input stream, with no user intera...

CVE-2021-39141

The CVE-2021-39141 entry concerns the XStream Java library, where an attacker can load and execute arbitrary code by manipulating the processed input stream. Affected versions permit code execution from a remote host; mitigation is to upgrade to XStream 1.4.18, which replaces a reliance on blackl...

CVE-2021-39150

XStream Java library (xstream) is affected by CVE-2021-39150. The flaw arises when processing the input stream, potentially allowing a remote attacker to access internal resources not publicly available. Affected description notes impact across Java runtimes from 14 to 8, and emphasizes that enab...

CVE-2021-39140

CVE-2021-39140 affects the XStream Java library. Connected sources describe a vulnerability in XStream up to version 1.4.18 that may allow a remote attacker to cause 100% CPU denial-of-service by manipulating the input stream; no user interaction required. Affected platforms reference upstream be...

CVE-2021-39146

CVE-2021-39146 is an XStream deserialization vulnerability that has been addressed in multiple IBM advisories. The issue allows remote code execution via unsafe object deserialization in XStream across products that bundle the library (e.g., Atlas eDiscovery Process Management, ITNCM, IBM Spectru...

CVE-2021-39145

The CVE-2021-39145 vulnerability affects the XStream Java library. In affected versions, a remote attacker can load and execute arbitrary code by manipulating the processed input stream. Public advisories reference XStream updates (e.g., Fedora, Debian, Amazon Linux 2) and indicate remediation th...

CVE-2021-39149

CVE-2021-39149 affects the XStream Java serialization library. The vulnerability permits a remote attacker to load and execute arbitrary code by manipulating the processed input stream. The issue is tied to XStream’s input handling and the move away from blacklist-based security (1.4.18), relying...

CVE-2021-39147

CVE-2021-39147 relates to XStream, a Java library for XML serialization. Publicly available documents confirm a remote code execution risk when processing input streams, with XStream 1.4.18 and related releases susceptible unless mitigations are applied. Connected sources describe the root cause ...

CVE-2019-17495

CVE-2019-17495 is a CSS injection flaw in Swagger UI prior to 3.23.11 using the Relative Path Overwrite (RPO) technique that can lead to exfiltration of sensitive data (e.g., CSRF tokens) via CSS-based input field values. Concrete details across connected docs show multiple IBM advisories referen...

CVE-2021-39154

XStream (Java) vulnerability CVE-2021-39154: in affected XStream releases (e.g., 1.4.18) a remote attacker can load and execute arbitrary code by manipulating the input stream. Multiple advisories (Debian, Fedora, Amazon Linux 2 ALAS, etc.) reference the same CVE family and urge upgrading libxstr...

CVE-2021-39153

CVE-2021-39153 affects XStream Java library. In affected releases, a remote attacker could load and execute arbitrary code by manipulating the processed input stream, when using XStream out of the box with certain Java runtimes (Java 14 to 8) or with JavaFX installed. The issue is tied to input-p...

CVE-2021-39148

Summary: CVE-2021-39148 affects XStream, a Java XML-serialization library. Multiple connected advisories confirm a remote code-execution risk by manipulating the processed input stream, with the attacker able to load and execute arbitrary code from a remote host. The issue is tied to how XStream ...

CVE-2020-11979

CVE-2020-11979 affects Apache Ant 1.10.8. The mitigation for CVE-2020-1945 changed temp-file permissions, but the fixcrlf task deleted the temp file and recreated it without protection, enabling an attacker to inject modified source files during builds. Connected advisories confirm the issue and ...

CVE-2021-36373

CVE-2021-36373 is a denial-of-service in Apache Ant caused by reading a specially crafted TAR archive that can exhaust memory, leading to OOM during builds. The initial description notes that Ant versions affected include 1.9.16 and 1.10.11 and that a memory exhaustion can disrupt builds. Connect...

CVE-2019-10219

The CVE-2019-10219 entry affects Hibernate Validator: SafeHtml validator annotation fails to sanitize HTML comments/instructions, enabling XSS in affected code paths. Affected CP4S versions are 1.7.2.0, 1.8.0.0, and 1.8.1.0. Remediation is to upgrade to Cloud Pak for Security 1.9.0.0 per IBM guid...

CVE-2018-8088

CVE-2018-8088 details (normal mode) : The issue affects SLF4J’s slf4j-ext EventData in QOS.CH SLF4J before 1.8.0-beta2, where crafted data can bypass access restrictions. The fix is in SLF4J 1.7.26+ and in the 2.0.x series. Connected advisories corroborate the vulnerability description across Lin...

CVE-2021-2351

CVE-2021-2351 affects Oracle Database Server’s Advanced Networking Option, with affected versions 12.1.0.2, 12.2.0.1, and 19c. The vulnerability allows unauthenticated network access via Oracle Net to compromise the Advanced Networking Option, with access requiring user interaction (UI_R) and ris...

CVE-2019-10173

XStream library vulnerability CVE-2019-10173 affects version 1.4.10 prior to 1.4.11, introducing a regression of CVE-2013-7285 where, if the security framework is not initialized, a remote attacker can execute arbitrary shell commands during unmarshalling XML or other supported formats (e.g., JSO...

CVE-2020-14756

CVE-2020-14756 : An insecure deserialization vulnerability in Oracle Coherence (Fusion Middleware Core Components) allows unauthenticated remote code execution via IIOP/T3. Affected versions include 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. Successful exploitation can lead to t...

CVE-2020-14895

The CVE-2020-14895 entry concerns Oracle Utilities Framework (System Wide) with affected versions 2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0–4.3.0.6.0, 4.4.0.0.0 and 4.4.0.2.0. The connected Red Hat/RedHat-agnostic sources confirm the vulnerability permits a low-privilege, network-accessible atta...

CVE-2026-21924

CVE-2026-21924 affects Oracle Utilities Application Framework within Oracle Utilities Applications. Vulnerable versions include 4.4.0.3.0–4.5.0.2.0 and 25.4, 25.10. The flaw resides in the Oracle Utilities Application Framework component and can be exploited by a low-privileged attacker with netw...