TI-2022-01345 CVE-2022-1471 · GHSA-mjmj-j48q-9wg2
Remote Code execution in SnakeYAML
Priority CRITICAL 88
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.
RHSA-2023:5165
Red Hat AMQ Streams 2.5.0 release and security update
Released 2023-09-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat AMQ Streams 2.5.0
Fixes 15 records
TI-2022-17150 CVE-2022-36944 · GHSA-8qv5-68g4-248j
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file.
Priority HIGH 82
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file.
TI-2023-17281 CVE-2023-34455 · GHSA-qcwq-55hx-v3vh
snappy-java's unchecked chunk length leads to DoS
Priority HIGH 72
snappy-java is a fast compressor/decompressor for Java.
TI-2023-17280 CVE-2023-34454 · GHSA-fjpj-2g6w-x25r
snappy-java's Integer Overflow vulnerability in compress leads to DoS
Priority HIGH 66
snappy-java is a fast compressor/decompressor for Java.
TI-2023-17279 CVE-2023-34453 · GHSA-pqr6-cmr2-h8hf
snappy-java's Integer Overflow vulnerability in shuffle leads to DoS
Priority HIGH 66
snappy-java is a fast compressor/decompressor for Java.
TI-2022-08636 CVE-2022-24823 · GHSA-269q-hmxg-m83q
Local Information Disclosure Vulnerability in io.netty:netty-codec-http
Priority MEDIUM 58
Netty is an open-source, asynchronous event-driven network application framework.
TI-2021-15209 CVE-2021-37137 · GHSA-9vjp-v76f-g363
Uncontrolled resource consumption in Netty
Priority MEDIUM 48
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.
TI-2021-15208 CVE-2021-37136 · GHSA-grg4-wf29-r9vv
Uncontrolled resource consumption in Netty
Priority MEDIUM 48
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).
TI-2023-11282 CVE-2023-26048 · GHSA-qw69-rqj8-6qw8
OutOfMemoryError for large multipart without filename in Eclipse Jetty
Priority LOW 36
Jetty is a java based web server and servlet engine.
TI-2023-03393 CVE-2023-3635 · GHSA-w33c-445m-f8w7
Okio GzipSource unhandled exception Denial of Service
Priority LOW 35
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer.
TI-2023-17287 CVE-2023-34462 · GHSA-6mjq-h674-j845
netty-handler SniHandler 16MB allocation
Priority LOW 34
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.
TI-2023-02788 CVE-2023-2976 · GHSA-7g45-4rm6-3mm3
Use of temporary directory for file creation in `FileBackedOutputStream` in Guava
Priority LOW 33
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with…
TI-2023-11283 CVE-2023-26049 · GHSA-p26g-97m4-6q7c
Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty
Priority LOW 27
Jetty is a java based web server and servlet engine.
TI-2023-16378 CVE-2023-33201 · GHSA-hr8g-6v94-x4m9
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability.
Priority LOW 25
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability.
TI-2023-00456 CVE-2023-0482 · GHSA-2c6g-pfx3-w7h8
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider…
Priority LOW 24
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.