Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…

Oracle Java SE and JRockit Unspecified Vulnerability

IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions

XStream is vulnerable to a Remote Command Execution attack

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake

IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation

SM2 Decryption Buffer Overflow

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name…

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code

libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable…

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary…

The Data Warehouse component in NetApp OnCommand Insight before 7.2.3 allows remote attackers to obtain administrative access by leveraging a default privileged account

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX)

XStream is vulnerable to an Arbitrary Code Execution attack

A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured…

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Java DB)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI)