https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:53:19 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-00169 bdu:2023-00169 https://cve.radiocsirt.org/vuln/bdu:2023-00169 https://cve.radiocsirt.org/vuln/euvd-2026-241327 EUVD-2026-241327 https://cve.radiocsirt.org/vuln/euvd-2026-241327 https://cve.radiocsirt.org/vuln/fkie_cve-2022-36944 <p>Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.</p> <p>Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-36944 https://cve.radiocsirt.org/vuln/ghsa-8qv5-68g4-248j <p><strong>Affected:</strong> Maven: org.scala-lang:scala-library</p> <p>Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with LazyList object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.</p> <p><strong>Affected:</strong> Maven: org.scala-lang:scala-library</p> <p>Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with LazyList object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.</p> https://cve.radiocsirt.org/vuln/ghsa-8qv5-68g4-248j https://cve.radiocsirt.org/vuln/gsd-2022-36944 gsd-2022-36944 https://cve.radiocsirt.org/vuln/gsd-2022-36944 https://cve.radiocsirt.org/vuln/rhsa-2023:3223 <p>jackson-databind: denial of service via a large depth of nested objects okhttp: information disclosure via improperly used cryptographic function netty-codec: Bzip2Decoder doesn&#39;t allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn&#39;t restrict chunk length and may buffer skippable chunks in an unnecessary way jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode netty: world readable temporary file containing sensitive data scala: deserialization gadget chain jettison: parser crash by stackoverflow jettison: memory exhaustion via user-supplied XML or JSON data jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS jackson-databind: use of deeply nested arrays Streams: component version with information disclosure flaw json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) kafka: RCE/DoS via SASL JAAS JndiLoginModule configuration in Kafka Connect</p> <p>jackson-databind: denial of service via a large depth of nested objects okhttp: information disclosure via improperly used cryptographic function netty-codec: Bzip2Decoder doesn&#39;t allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn&#39;t restrict chunk length and may buffer skippable chunks in an unnecessary way jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode netty: world readable temporary file containing sensitive data scala: deserialization gadget chain jettison: parser crash by stackoverflow jettison: memory exhaustion via user-supplied XML or JSON data jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS jackson-databind: use of deeply nested arrays Streams: component version with information disclosure flaw json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) kafka: RCE/DoS via SASL JAAS JndiLoginModule configuration in Kafka Connect</p> https://cve.radiocsirt.org/vuln/rhsa-2023:3223 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-36944 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: scala, Ubuntu:Pro:18.04:LTS: scala, Ubuntu:Pro:20.04:LTS: scala, Ubuntu:22.04:LTS: scala, Ubuntu:24.04:LTS: scala, Ubuntu:25.04: scala</p> <p>Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: scala, Ubuntu:Pro:18.04:LTS: scala, Ubuntu:Pro:20.04:LTS: scala, Ubuntu:22.04:LTS: scala, Ubuntu:24.04:LTS: scala, Ubuntu:25.04: scala</p> <p>Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-36944 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2345 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Camunda ausnutzen, um seine Privilegien zu erhöhen und Sicherheitsmaßnahmen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Camunda ausnutzen, um seine Privilegien zu erhöhen und Sicherheitsmaßnahmen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2345