Most recent entries from all

bdu:2020-01665

certfr-2025-avi-0746 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2025-avi-0746

EUVD-2026-50287

fkie_cve-2019-5427

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

GHSA-84p2-vf58-xhxv — Billion laughs attack in c3p0

Affected: Maven: com.mchange:c3p0

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

gsd-2019-5427

openSUSE-SU-2024:11961-1 — c3p0-0.9.5.5-2.1 on GA media

c3p0-0.9.5.5-2.1 on GA media

RHSA-2020:0983 — Red Hat Security Advisory: Red Hat Fuse 7.6.0 security update

jquery: Cross-site scripting via cross-domain ajax requests logback: Serialization vulnerability in SocketServer and ServerSocketReceiver js-jquery: XSS in responses from cross-origin ajax requests apache-commons-compress: ZipArchiveInputStream.read() fails to identify correct EOF allowing for DoS via crafted zip jetty: full server path revealed when using the default Error Handling springframework: DoS Attack via Range Requests spring-data-api: potential information disclosure through maliciously crafted example value in ExampleMatcher undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed c3p0: loading XML configuration leads to denial of service HTTP/2: flood using PING frames results in unbounded memory growth HTTP/2: flood using PRIORITY frames results in excessive resource consumption HTTP/2: flood using HEADERS frames results in unbounded memory growth HTTP/2: flood using SETTINGS frames results in unbounded memory growth HTTP/2: 0-length headers lead to denial of service HTTP/2: request for large response leads to denial of service HTTP/2: flood using empty frames results in excessive resource consumption infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods undertow: Information leak in requests for directories without trailing slashes jetty: using specially formatted URL against DefaultServlet or ResourceHandler leads to XSS conditions jetty: error path information disclosure spring-secur…

SUSE-SU-2022:0798-1 — Security update for SUSE Manager Server 4.1

Security update for SUSE Manager Server 4.1

UBUNTU-CVE-2019-5427

Affected: Ubuntu:Pro:14.04:LTS: c3p0, Ubuntu:Pro:16.04:LTS: c3p0, Ubuntu:18.04:LTS: c3p0, Ubuntu:20.04:LTS: c3p0, Ubuntu:22.04:LTS: c3p0, Ubuntu:24.04:LTS: c3p0

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

WID-SEC-W-2025-1905 — IBM QRadar SIEM Komponente: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM Komponenten ausnutzen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.