Most recent entries from all

bdu:2025-09868

certfr-2023-avi-0791 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2023-avi-0791

EUVD-2026-223328

fkie_cve-2023-0482

In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.

GHSA-2c6g-pfx3-w7h8 — Insecure Temporary File in RESTEasy

Affected: Maven: org.jboss.resteasy:resteasy-core, Maven: org.jboss.resteasy:resteasy-multipart-provider

### Impact In RESTEasy the insecure `File.createTempFile()` is used in the `DataSourceProvider`, `FileProvider` and `Mime4JWorkaround` classes which creates temp files with insecure permissions that could be read by a local user.

### Patches Fixed in the following pull requests:

* https://github.com/resteasy/resteasy/pull/3409 (7.0.0.Alpha1) * https://github.com/resteasy/resteasy/pull/3423 (6.2.3.Final) * https://github.com/resteasy/resteasy/pull/3412 (5.0.6.Final) * https://github.com/resteasy/resteasy/pull/3413 (4.7.8.Final) * https://github.com/resteasy/resteasy/pull/3410 (3.15.5.Final)

### Workarounds There is no workaround for this issue.

### References * https://nvd.nist.gov/vuln/detail/CVE-2023-0482 * https://bugzilla.redhat.com/show_bug.cgi?id=2166004 * https://github.com/advisories/GHSA-jrmh-v64j-mjm9

gsd-2023-0482

RHSA-2023:1512 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update

SnakeYaml: Constructor Deserialization Remote Code Execution undertow: Server identity in https connection is not checked by the undertow client snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode hsqldb: Untrusted input may lead to RCE attack dev-java/snakeyaml: DoS via stack overflow codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider RESTEasy: creation of insecure temp files Undertow: Infinite loop in SslConduit during close

tssa-2025-00001 — Project CSAF document

Detailed list of project vulnerabilities

UBUNTU-CVE-2023-0482

Affected: Ubuntu:Pro:16.04:LTS: resteasy, Ubuntu:Pro:18.04:LTS: resteasy3.0, Ubuntu:Pro:20.04:LTS: resteasy, Ubuntu:Pro:20.04:LTS: resteasy3.0, Ubuntu:22.04:LTS: resteasy3.0, Ubuntu:Pro:22.04:LTS: resteasy, Ubuntu:24.04:LTS: resteasy3.0, Ubuntu:Pro:24.04:LTS: resteasy, Ubuntu:25.10: resteasy, Ubuntu:25.10: resteasy3.0 and 2 more

WID-SEC-W-2023-0919 — IBM WebSphere Application Server Liberty: Schwachstelle ermöglicht Privilegieneskalation

Ein lokaler Angreifer kann eine Schwachstelle in IBM WebSphere Application Server Liberty ausnutzen, um seine Privilegien zu erhöhen.