An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet…

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop

Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

Infinite loop within Apache XercesJ xml parser

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space…

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected)

A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and…

A vulnerability was found in Hibernate-Validator

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups

ckeditor is an open source WYSIWYG HTML editor with rich content support

ckeditor is an open source WYSIWYG HTML editor with rich content support

ckeditor is an open source WYSIWYG HTML editor with rich content support

Possible limited path traversal vulnerabily in Apache Commons IO