Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Withdrawn by the publisher.

Affected: Maven: commons-jxpath:commons-jxpath

## This advisory has been withdrawn due to the CVE being rejected.

## Original advisory text Those using JXPath to interpret untrusted XPath expressions may be vulnerable to a remote code execution attack. All JXPathContext class functions processing a XPath string are vulnerable except `compile()` and `compilePath()` function. The XPath expression can be used by an attacker to load any Java class from the classpath resulting in code execution.

apache-commons-net: FTP client trusts the host from PASV response by default undertow: Server identity in https connection is not checked by the undertow client snakeyaml: Denial of Service due to missing nested depth limitation for collections apache-spark: XSS vulnerability in log viewer UI Javascript Pulsar: Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM apache-ivy: Directory Traversal Ivy: Ivy Path traversal batik: Server-Side Request Forgery batik: Server-Side Request Forgery snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode scandium: Failing DTLS handshakes may cause throttling to block processing of records batik: Server-Side Request Forgery (SSRF) vulnerability jettison: memory exhaustion via user-supplied XML or JSON data xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks batik: Apache XML Graphics Batik vulnerable to code execution via SVG JXPath: untrusted XPath expressions may lead to RCE attack hsqldb: Untrusted input may lead to RC…

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: libcommons-jxpath-java

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Integration Camel for Spring Boot ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität zu gefährden.