ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL…

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop

Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Content Backup page

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Data Server Connection page

XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)

XStream can cause a Denial of Service

XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights

Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector)

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated attacker to cause a denial of service due a hang…

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and…

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support…

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session

A flaw was found in WildFly Elytron version 1.11.3.Final and before

A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error

Segmentation fault in SSL_check_chain

Vulnerability in the Java SE product of Oracle Java SE (component: JSSE)

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to send specially crafted packets to cause a…

IBM Cognos Analytics 11.0, and 11.1 is vulnerable to a denial of service attack that could allow a remote user to send specially crafted requests that would consume all available…

Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified…

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries)

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured…

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web…

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security)

An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D)

The c_rehash script allows command injection

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer)

A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests