OnCommand Insight versions 7.3.1 through 7.3.14 are susceptible to an authentication bypass vulnerability in the Data Warehouse component

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11

A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)

Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot)

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously…

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection

A flaw was found in jackson-databind before 2.9.10.7

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting)

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow, caused by improper bounds checking…

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as…

IBM Cognos Analytics 11.0 could store cached credentials locally that could be obtained by a local user

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication)

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request

A flaw was found in Undertow

A flaw was found in Undertow

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could allow an attacker…

IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Windows)

Vulnerability in the Java SE product of Oracle Java SE (component: Deployment)

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression)

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line…

libcurl-using applications can ask for a specific client certificate to be used in a transfer