https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:05:19 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-04278 bdu:2022-04278 https://cve.radiocsirt.org/vuln/bdu:2022-04278 https://cve.radiocsirt.org/vuln/certfr-2022-avi-1059 certfr-2022-avi-1059 https://cve.radiocsirt.org/vuln/certfr-2022-avi-1059 https://cve.radiocsirt.org/vuln/cnvd-2022-49973 cnvd-2022-49973 https://cve.radiocsirt.org/vuln/cnvd-2022-49973 https://cve.radiocsirt.org/vuln/euvd-2026-17740 EUVD-2026-17740 https://cve.radiocsirt.org/vuln/euvd-2026-17740 https://cve.radiocsirt.org/vuln/fkie_cve-2022-33980 <p>Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is &#34;${prefix:name}&#34;, where &#34;prefix&#34; is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - &#34;script&#34; - execute expressions using the JVM script execution engine (javax.script) - &#34;dns&#34; - resolve dns records - &#34;url&#34; - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.</p> <p>Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is &#34;${prefix:name}&#34;, where &#34;prefix&#34; is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - &#34;script&#34; - execute expressions using the JVM script execution engine (javax.script) - &#34;dns&#34; - resolve dns records - &#34;url&#34; - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-33980 https://cve.radiocsirt.org/vuln/ghsa-xj57-8qj4-c4m6 <p><strong>Affected:</strong> Maven: org.apache.commons:commons-configuration2</p> <p>Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is &#34;${prefix:name}&#34;, where &#34;prefix&#34; is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - &#34;script&#34; - execute expressions using the JVM script execution engine (javax.script) - &#34;dns&#34; - resolve dns records - &#34;url&#34; - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.</p> <p><strong>Affected:</strong> Maven: org.apache.commons:commons-configuration2</p> <p>Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is &#34;${prefix:name}&#34;, where &#34;prefix&#34; is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - &#34;script&#34; - execute expressions using the JVM script execution engine (javax.script) - &#34;dns&#34; - resolve dns records - &#34;url&#34; - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.</p> https://cve.radiocsirt.org/vuln/ghsa-xj57-8qj4-c4m6 https://cve.radiocsirt.org/vuln/gsd-2022-33980 gsd-2022-33980 https://cve.radiocsirt.org/vuln/gsd-2022-33980 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13259-1 <p>apache-commons-configuration2-2.9.0-1.1 on GA media</p> <p>apache-commons-configuration2-2.9.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13259-1 https://cve.radiocsirt.org/vuln/rhsa-2022:6916 <p>gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation netty: world readable temporary file containing sensitive data apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults activemq-artemis: AMQ Broker web console HTML Injection</p> <p>gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation netty: world readable temporary file containing sensitive data apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults activemq-artemis: AMQ Broker web console HTML Injection</p> https://cve.radiocsirt.org/vuln/rhsa-2022:6916 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-33980 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: commons-configuration2, Ubuntu:20.04:LTS: commons-configuration2, Ubuntu:22.04:LTS: commons-configuration2</p> <p>Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is &#34;${prefix:name}&#34;, where &#34;prefix&#34; is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - &#34;script&#34; - execute expressions using the JVM script execution engine (javax.script) - &#34;dns&#34; - resolve dns records - &#34;url&#34; - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: commons-configuration2, Ubuntu:20.04:LTS: commons-configuration2, Ubuntu:22.04:LTS: commons-configuration2</p> <p>Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is &#34;${prefix:name}&#34;, where &#34;prefix&#34; is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - &#34;script&#34; - execute expressions using the JVM script execution engine (javax.script) - &#34;dns&#34; - resolve dns records - &#34;url&#34; - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-33980 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0590 <p>Ein entfernter Angreifer kann eine Schwachstelle in Apache Commons ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter Angreifer kann eine Schwachstelle in Apache Commons ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0590