Most recent entries from all

bdu:2022-06227

fkie_cve-2022-41852

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Withdrawn: GHSA-wrx5-rp7m-mm49 — Withdrawn: CVE Rejected: JXPath vulnerable to remote code execution when interpreting untrusted XPath expressions

Withdrawn by the publisher.

Affected: Maven: commons-jxpath:commons-jxpath

## This advisory has been withdrawn due to the CVE being rejected.

## Original advisory text Those using JXPath to interpret untrusted XPath expressions may be vulnerable to a remote code execution attack. All JXPathContext class functions processing a XPath string are vulnerable except `compile()` and `compilePath()` function. The XPath expression can be used by an attacker to load any Java class from the classpath resulting in code execution.

gsd-2022-41852

RHSA-2023:2100 — Red Hat Security Advisory: Red Hat Integration Camel for Spring Boot 3.20.1 security update

apache-commons-net: FTP client trusts the host from PASV response by default undertow: Server identity in https connection is not checked by the undertow client snakeyaml: Denial of Service due to missing nested depth limitation for collections apache-spark: XSS vulnerability in log viewer UI Javascript Pulsar: Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM apache-ivy: Directory Traversal Ivy: Ivy Path traversal batik: Server-Side Request Forgery batik: Server-Side Request Forgery snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode scandium: Failing DTLS handshakes may cause throttling to block processing of records batik: Server-Side Request Forgery (SSRF) vulnerability jettison: memory exhaustion via user-supplied XML or JSON data xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks batik: Apache XML Graphics Batik vulnerable to code execution via SVG JXPath: untrusted XPath expressions may lead to RCE attack hsqldb: Untrusted input may lead to RC…

Withdrawn: UBUNTU-CVE-2022-41852

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: libcommons-jxpath-java

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

WID-SEC-W-2023-1142 — Red Hat Integration Camel for Spring Boot: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Integration Camel for Spring Boot ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität zu gefährden.