Red Hat Security AdvisoryRHSA-2022:8652
Red Hat Fuse 7.11.1 release and security update
Released 2022-11-28 · Red Hat rating Important · View on Red Hat →
Fixes 17 records
Priority CRITICAL 94
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99931 · Published 2022-10-13 · Partial fix · 1.10.0 CWE-94
Priority HIGH 72
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05551 · Published 2022-07-06 · Partial fix · 2.29.4 CWE-400
Priority HIGH 71
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.44644 · Published 2022-07-06 · Partial fix · 2.8.0 CWE-74
Priority HIGH 70
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.02355 · Published 2022-08-03 · Partial fix · 42.2.26, 42.4.1 +1 CWE-89
Priority MEDIUM 63
URI.js is a Javascript URL mutation library.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01941 · Published 2022-03-03 · Partial fix · 1.19.9 CWE-20
Priority MEDIUM 58
Netty is an open-source, asynchronous event-driven network application framework.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.01044 · Published 2022-05-06 · Partial fix · 4.1.77.Final CWE-378
Priority MEDIUM 56
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04581 · Published 2022-03-17 · Partial fix · 1.2.6, 0.2.4 CWE-1321
Priority MEDIUM 54
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.1384 · Published 2022-04-04 · Partial fix · 2.29.2 CWE-22
Priority MEDIUM 51
Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05145 · Published 2022-10-06 · Partial fix · 2.7.1 CWE-470
Priority MEDIUM 44
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.16404 · Published 2019-02-20 · Partial fix · 4.3.1, 3.4.1 +1 CWE-79
Priority LOW 38
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02932 · Published 2022-08-30 · Partial fix · 1.31 CWE-776
Priority LOW 38
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02562 · Published 2022-07-07 · Partial fix · 9.4.47, 10.0.10 +1 CWE-410
Priority LOW 37
A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02281 · Published 2021-06-01 · Partial fix · 1.3.3, 2.4.4 CWE-787
Priority LOW 35
When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/prox…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01093 · Published 2022-08-05 · Partial fix · 2.2.19.Final, 2.3.0.Alpha2 CWE-400
Priority LOW 34
A flaw was found in Wildfly.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00315 · Published 2022-05-24 · Partial fix · 17.0 CWE-552
Priority LOW 33
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02199 · Published 2022-09-05 · Partial fix · 1.31 CWE-121
Priority LOW 32
Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01537 · Published 2022-02-16 · Partial fix · 1.19.8 CWE-639
THREATIST.IORead the docs