Apple Multiple Products WebKit Code Execution Vulnerability

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like…

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes,…

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation

Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment)

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously…

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization)

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python)

NetApp OnCommand Workflow Automation before 3.1P2 allows remote attackers to bypass authentication via unspecified vectors

Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as…

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication)

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate)

Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

A flaw was found in undertow

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep…

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested…

A flaw was found in Undertow

A flaw was found in Undertow

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line…

libcurl-using applications can ask for a specific client certificate to be used in a transfer

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL…

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access…

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly