THREATIST.IORead the docs Red Hat Fuse 7.6.0 security update
Released 2020-03-26 · Red Hat rating Important · View on Red Hat →
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service.
An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library.
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization.
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code ex…
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service.
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service.
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2.
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through t…
A vulnerability was found in Undertow web server before 2.0.21.
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges.
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9.
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandle…
undertow before version 2.0.23.Final is vulnerable to an information leak issue.
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder.
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource l…
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached.
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServl…
This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20.