Oracle Communications Messaging Server 8.1

SQL injection in JDBC Appender in Apache Log4j V1

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.

A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

Bypass of the secureValidation property

Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

Apache CXF Reflected XSS in the services listing page via the styleSheetPath

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

Possible request smuggling in HTTP/2 due missing validation of content-length

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file

A carefully crafted PDF file can trigger an infinite loop while loading the file

A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.

A carefully crafted PDF file can trigger an infinite loop while loading the file

A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.

Infinite loop in Apache Tika's MP3 parser

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.