CVE-2022-41862

CVE-2022-41862 affects PostgreSQL libpq/client memory disclosure when connecting with Kerberos to a modified server. Connected documents confirm impact across multiple package tracks (libpq for AL2/Linux distros and PostgreSQL server/client suites for various versions, including 12.x–15.x), with ...

CVE-2021-4104

CVE-2021-4104 affects JMSAppender in Log4j 1.2 when it is explicitly configured to use JMSAppender. A deserialization of untrusted data can occur if an attacker can write Log4j configuration and supply TopicBindingName and TopicConnectionFactoryBindingName, causing JMSAppender to perform JNDI req...

CVE-2021-3690

CVE-2021-3690 affects Undertow: a buffer leak on the incoming WebSocket PONG message can cause memory exhaustion leading to DoS. The vulnerability impacts Undertow-based components (WebSocket handling). A security update/patch for Undertow is available per OSV/OESA entries; exploit details are no...

CVE-2022-0084

CVE-2022-0084 affects XNIO: the notifyReadClosed path logs to the opposite end, enabling an attacker to send malformed requests that may cause log contention or disk space exhaustion. Connected docs confirm this root cause and cite IBM/Red Hat advisories linking the CVE to XNIO, with remediation ...

CVE-2021-3536

CVE-2021-3536 concerns WildFly/JBoss EAP domain-mode admin console vulnerability allowing XSS via the name field when creating roles, affecting Confidentiality and Integrity. Affected software is WildFly (prior to 23.0.2.Final). The issue arises in the domain mode role-creation flow and can be tr...

CVE-2023-4853

CVE-2023-4853 affects Quarkus, where HTTP security policy sanitization fails for certain character permutations in requests. The root cause is improper sanitization, allowing bypass of the security policy and potentially granting unauthorized access to endpoints and causing denial of service. The...

CVE-2021-3642

CVE-2021-3642 describes a timing-attack vulnerability in Wildfly Elytron’s ScramServer, affecting versions prior to 1.10.14.Final, 1.15.5.Final, and 1.16.1.Final. The highest impact is confidentiality; no exploitation details are provided in the documents. Connected advisories (e.g., Red Hat RHSA...

CVE-2021-4178

CVE-2021-4178 affects the Fabric8 Kubernetes client (versions 5.0.0-beta-1 and newer) due to unsafe YAML parsing in unmarshalYaml, enabling local, privileged code execution via a crafted YAML payload. The issue is confirmed across multiple sources (NVD/NVD-derived entry and Red Hat/Jenkins adviso...