jboss amq clients 2 vulnerabilities and exploits

(subscribe to this query)

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel d...

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content ...

Snakeyaml Project Snakeyaml

11 Github repositories1 Article

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service...

Snakeyaml Project Snakeyaml Fedoraproject Fedora 36 Fedoraproject Fedora 37

2 Github repositories

The package org.yaml:snakeyaml from 0 and prior to 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

Snakeyaml Project Snakeyaml Debian Debian Linux 10.0

Apache Log4j2 versions 2.0-beta7 up to and including 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the tar...

34 Github repositories4 Articles

HttpObjectDecoder.java in Netty prior to 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

Netty Netty Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Fedoraproject Fedora 33 Canonical Ubuntu Linux 18.04 Redhat Jboss Amq Clients 2 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3

HttpObjectDecoder.java in Netty prior to 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Netty Netty Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Fedoraproject Fedora 33 Canonical Ubuntu Linux 18.04 Redhat Jboss Amq Clients 2 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Apache Spark 2.4.7 Apache Spark 2.4.8

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually writ...

1 Github repository

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook