Most recent entries from all

EUVD-2026-237368

fkie_cve-2022-23596

Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.

GHSA-m6cj-93v6-cvr5 — Junrar vulnerable to infinite loop via extracting carefully crafted RAR archive

Affected: Maven: com.github.junrar:junrar

### Impact A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users.

### Patches The problem is partially patched in 7.4.1

### Workarounds None

### References

https://github.com/junrar/junrar/issues/73

https://github.com/junrar/junrar/issues/81

gsd-2022-23596

RHSA-2022:5532 — Red Hat Security Advisory: Red Hat Fuse 7.11.0 release and security update

elasticsearch: not properly preserving security permissions when executing complex queries may lead to information disclosure tomcat: deserialization flaw in session persistence storage leading to RCE junit4: TemporaryFolder is shared between all users across system which could result in information disclosure wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure jackson-databind: denial of service via a large depth of nested objects mysql-connector-java: unauthorized access to critical undertow: potential security issue in flow control over HTTP/2 may lead to DOS wildfly-elytron: possible timing attack in ScramServer wildfly-core: Invalid Sensitivity Classification of Vault Expression nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes undertow: client side invocation timeout raised when calling over HTTP2 kubernetes-client: Insecure deserialization in unmarshalYaml method springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096) springframework: malicious input leads to insertion of additional log entries spring-security: Denial-of-Service (DoS) attack via initiation of Authorization Request protobuf-java: potential DoS in the parsing procedure for binary data google-oauth-client: Token signature not verified tomcat: Inf…

WID-SEC-W-2022-0607 — Red Hat FUSE: Mehrere Schwachstellen

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, einen Denial of Service Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.