Oracle Java SE and JRockit Unspecified Vulnerability

Apple Multiple Products WebKit Code Execution Vulnerability

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like…

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES

SM2 Decryption Buffer Overflow

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name…

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with…

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of…

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code

libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic…

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from…

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select…

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable…

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary…

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI)

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take…

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Java DB)

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes,…

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation

Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment)

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously…