quarkusio

pgjdbc is the offical PostgreSQL JDBC Driver.

Quarkus is a Java framework for building cloud-native applications.

A vulnerability was found in quarkus.

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is…

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

jsoup is a Java library for working with HTML.

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).

It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.

A flaw was found in the json payload.

A flaw was found in Quarkus.

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks.

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request executio…

In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it.

PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.

A vulnerability was found in Quarkus in the quarkus-security-webauthn module.

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions.

A flaw was found in Quarkus.

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final.

Quarkus is a Java framework for building cloud-native applications.

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGL…