| Improper Restriction of XML External Entity Reference in CastorCVE-2014-3004 · GHSA-JWWR-FJGH-CV2X |
castor:castororg.codehaus.castor:castor |
MavenRed Hat |
Medium
|
Fix reported |
|
| XML External Entity Injection in XStreamCVE-2016-3674 · GHSA-RGH3-987H-WPMW |
com.thoughtworks.xstream:xstreamRed Hat BPM Suite 6/xstream |
MavenRed Hat |
High
|
Fix reported |
|
| Improper Input Validation in Apache POICVE-2014-3574 · GHSA-5WFP-8643-C58X |
org.apache.poi:poiRed Hat BPM Suite 6/apache-poi |
MavenRed Hat |
Medium
|
Fix reported |
|
| Improper Restriction of XML External Entity Reference in Apache POICVE-2014-3529 · GHSA-Q56H-JJJ6-52MF |
org.apache.poi:poiRed Hat BPM Suite 6/apache-poi |
MavenRed Hat |
Medium
|
Fix reported |
|
| Improper Validation of Certificates in apache axisCVE-2014-3596 · GHSA-R53V-VM87-F72C |
axis:axisorg.apache.axis:axis |
MavenRed Hat |
Medium
|
No fix reported |
|
| Incorrect Default Permissions in Apache Commons FileUploadCVE-2013-0248 · GHSA-VM69-474V-7Q2W |
commons-fileupload:commons-fileuploadRed Hat Enterprise Linux 5/jakarta-commons-fileupload |
MavenRed Hat |
Low
|
Fix reported |
|
| Cross-Site Request Forgery in Spring FrameworkCVE-2013-6429 · GHSA-G6HF-F9CQ-Q7W7 |
org.springframework:spring-webOpenShift Enterprise 1/activemq |
MavenRed Hat |
Medium
|
Fix reported |
|
| Missing XML Validation in Apache Xerces2CVE-2013-4002 · GHSA-7J4H-8WPF-RQFH |
xerces:xercesImplRed Hat Enterprise Linux 5/xerces-j2 |
MavenRed Hat |
High
|
Fix reported |
|
| Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache GroovyCVE-2015-3253 · GHSA-QG25-HGJV-CG9Q |
org.codehaus.groovy:groovy-allorg.codehaus.groovy:groovy |
MavenRed Hat |
Critical
|
Fix reported |
|
| Deserialization of Untrusted Data in GroovyCVE-2016-6814 · GHSA-XPHJ-M9CC-8FMQ |
org.codehaus.groovy:groovy-allorg.codehaus.groovy:groovy |
MavenRed Hat |
Critical
|
Fix reported |
|
| Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerabilityCVE-2014-4172 · GHSA-9FC5-Q25C-R2WR |
jasig/phpcasorg.jasig.cas:cas-client |
ComposerMavenNuGetRed Hat |
Critical
|
Fix reported |
|
| jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code executionCVE-2017-15095 · GHSA-H592-38CM-4GGP |
com.fasterxml.jackson.core:jackson-databindRed Hat Enterprise Virtualization 3/jasperreports-server-pro |
MavenRed Hat |
Critical
|
Fix reported |
|
| Deserialization of Untrusted Data in Log4jCVE-2017-5645 · GHSA-FXPH-Q3J8-MV87 |
org.apache.logging.log4j:log4j-coreorg.apache.logging.log4j:log4j |
MavenRed Hat |
Critical
|
Fix reported |
|
| jackson-databind is vulnerable to a deserialization flawCVE-2017-7525 · GHSA-QXXX-2PP7-5HMX |
com.fasterxml.jackson.core:jackson-databindRed Hat Enterprise Virtualization 3/jasperreports-server-pro |
MavenRed Hat |
Critical
|
Fix reported |
|
| jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypassCVE-2017-17485 · GHSA-RFX6-VP9G-RH7V |
com.fasterxml.jackson.core:jackson-databindRed Hat Enterprise Virtualization 3/jasperreports-server-pro |
MavenRed Hat |
Critical
|
Fix reported |
|
| Improper Restriction of XML External Entity Reference in Spring FrameworkCVE-2014-0225 · GHSA-F93F-G33R-8PCP |
org.springframework:spring-webmvcOpenShift Enterprise 1/activemq |
MavenRed Hat |
High
|
Fix reported |
|
| Deserialization of Untrusted Data in Apache commons collectionsCVE-2015-7501 · GHSA-FJQ5-5J5F-MVXH |
commons-collections:commons-collectionsnet.sourceforge.collections:collections-generic |
MavenRed Hat |
Critical
|
Fix reported |
|
| Insecure Default Initialization of Resource in Pivotal Spring Web FlowCVE-2017-8039 · GHSA-Q4V9-QJMW-J7VF |
org.springframework.webflow:spring-webflowRed Hat Enterprise Virtualization 3/jasperreports-server-pro |
MavenRed Hat |
Medium
|
Fix reported |
|
| Insecure Default Initialization of Resource in Pivotal Spring Web FlowCVE-2017-4971 · GHSA-FG9W-CFFM-PMH2 |
org.springframework.webflow:spring-webflowRed Hat Enterprise Virtualization 3/jasperreports-server-pro |
MavenRed Hat |
Medium
|
Fix reported |
|
| Improper Input Validation in Apache BatikCVE-2015-0250 · GHSA-WFW6-MMMP-87XM |
org.apache.xmlgraphics:batikRed Hat Enterprise Linux 6/batik |
MavenRed Hat |
Medium
|
Fix reported |
|
