Most recent entries from all

bdu:2020-02137

certfr-2020-avi-433 — De multiples vulnérabilités ont été découvertes dans Oracle Database Server. Certaines d'entre elles permettent à un at…

certfr-2020-avi-433

cnvd-2020-22364

EUVD-2026-195659

fkie_cve-2019-13990

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

GHSA-9qcf-c26r-x5rf — XML external entity injection in Terracotta Quartz Scheduler

Affected: Maven: org.quartz-scheduler:quartz

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

gsd-2019-13990

RHSA-2020:3196 — Red Hat Security Advisory: Red Hat Decision Manager 7.8.0 Security Update

HTTP/2: flood using PING frames results in unbounded memory growth HTTP/2: flood using HEADERS frames results in unbounded memory growth HTTP/2: flood using SETTINGS frames results in unbounded memory growth HTTP/2: flood using empty frames results in excessive resource consumption cxf: does not restrict the number of message attachments cxf: OpenId Connect token service does not properly validate the clientId libquartz: XXE attacks via job description netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers cxf: reflected XSS in the services listing page jackson-databind: lacks certain net.sf.ehcache blocking netty: HTTP request smuggling netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header keycloak: security issue on reset credential flow netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling jackson-databind: Lacks certain xbean-reflect/JNDI blocking jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvide…

SUSE-SU-2020:0984-1 — Security update for quartz

Security update for quartz

UBUNTU-CVE-2019-13990

Affected: Ubuntu:16.04:LTS: libquartz-java, Ubuntu:18.04:LTS: libquartz-java, Ubuntu:18.04:LTS: libquartz2-java, Ubuntu:20.04:LTS: libquartz-java, Ubuntu:20.04:LTS: libquartz2-java, Ubuntu:22.04:LTS: libquartz-java, Ubuntu:24.04:LTS: libquartz-java, Ubuntu:25.10: libquartz-java, Ubuntu:26.04:LTS: libquartz-java

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

WID-SEC-W-2023-2700 — Atlassian Confluence: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Confluence, Atlassian Jira Software, Atlassian Bitbucket und Atlassian Bamboo ausnutzen, um Administratorrechte zu erlangen, Informationen offenzulegen, beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.