CVE-2020-8908 vulnerabilities and exploits

(subscribe to this query)

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the ...

Google Guava Quarkus Quarkus Oracle Commerce Guided Search 11.3.2 Oracle Communications Cloud Native Core Network Slice Selection Function 1.2.1 Oracle Communications Pricing Design Center 12.0.0.4.0 Oracle Communications Pricing Design Center 12.0.0.5.0 Oracle Data Integrator 12.2.1.3.0 Oracle Data Integrator 12.2.1.4.0 Oracle Nosql Database Oracle Peoplesoft Enterprise Peopletools 8.57 Oracle Peoplesoft Enterprise Peopletools 8.58 Oracle Peoplesoft Enterprise Peopletools 8.59

4 Github repositories

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Fasterxml Jackson-databind Netapp Oncommand Api Services -Netapp Oncommand Workflow Automation -Netapp Service Level Manager -Fedoraproject Fedora 32 Quarkus Quarkus Apache Iotdb Oracle Agile Plm 9.3.6 Oracle Agile Product Lifecycle Management Integration Pack 3.6 Oracle Banking Apis Oracle Banking Apis 19.1 Oracle Banking Apis 19.2

1 Github repository1 Article

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

1 Github repository

jackson-databind 2.10.x up to and including 2.12.x prior to 2.12.6 and 2.13.x prior to 2.13.1 allows malicious users to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

Fasterxml Jackson-databind Fasterxml Jackson-databind 2.13.0

A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an malicious user to access or modify potentially sensitive information.

Redhat Keycloak -

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an malicious user to cause a denial of service.

Redhat Integration Camel K -Redhat Resteasy Netapp Oncommand Insight -

In Reactor Netty HTTP Server, versions 1.1.x before 1.1.13 and versions 1.0.x before 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP ...

Pivotal Reactor Netty

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulne...

Redhat Resteasy Quarkus Quarkus

keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive inf...

Redhat Keycloak 20.0.2

In Reactor Netty HTTP Server, versions 1.1.x before 1.1.13 and versions 1.0.x before 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is...

Pivotal Reactor Netty

3 Github repositories

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook