CVSS: 6.5EPSS: 0%CPEs: 429EXPL: 0CVE-2019-10219 – hibernate-validator: safeHTML validator allows XSS
https://notcve.org/view.php?id=CVE-2019-10219
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack. Una vulnerabilidad fue encontrada en Hibernate-Validator. La anotación del validador SafeHtml no puede sanear apropiadamente las cargas útiles que consisten en código potencialmente malicioso en los comentarios e instrucciones HTML. • https://access.redhat.com/errata/RHSA-2020:0159 https://access.redhat.com/errata/RHSA-2020:0160 https://access.redhat.com/errata/RHSA-2020:0161 https://access.redhat.com/errata/RHSA-2020:0164 https://access.redhat.com/errata/RHSA-2020:0445 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219 https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3E https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba0911 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 110EXPL: 0CVE-2019-10086 – apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default
https://notcve.org/view.php?id=CVE-2019-10086
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean. En Apache Commons Beanutils 1.9.2, se agregó una clase especial BeanIntrospector que permite suprimir la capacidad de un atacante para acceder al cargador de clases a través de la propiedad de clase disponible en todos los objetos Java. Sin embargo, no se esta usando esta característica por defecto de PropertyUtilsBean. A flaw was found in the Apache Commons BeanUtils, where the class property in PropertyUtilsBean is not suppressed by default. • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%3e https://access.redhat.com/errata/RHSA-2019:4317 https://access.redhat.com/errata/RHSA-2020:0057 https://access.redhat.com/errata/RHSA-2020:0194 https://access.redhat.com/errata/RHSA-2020:0804 https://access.redhat.com/errata/RHSA-2020:0805 https://access.redhat.com/errata/RHSA-2020:0806 • CWE-502: Deserialization of Untrusted Data •
CVSS: 4.8EPSS: 0%CPEs: 28EXPL: 1CVE-2010-2526 – lvm2-cluster: insecurity when communicating between lvm2 and clvmd
https://notcve.org/view.php?id=CVE-2010-2526
The cluster logical volume manager daemon (clvmd) in lvm2-cluster in LVM2 before 2.02.72, as used in Red Hat Global File System (GFS) and other products, does not verify client credentials upon a socket connection, which allows local users to cause a denial of service (daemon exit or logical-volume change) or possibly have unspecified other impact via crafted control commands. El cluster logical volume manager daemon (clvmd) en lvm2-cluster en LVM2 anterior v2.02.72, como el usado en Red Hat Global File System (GFS) y otros productos, no verifica las credenciales de cliente sobre una conexión socket, permitiendo a usuarios locales causar una denegación de servicio (cuelgue del demonio o cambio de volumen lógico) o probablemente tener otros impactos a través de comandos de control manipulados. • http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://secunia.com/advisories/40759 http://securitytracker.com/id?1024258 http://www.osvdb.org/66753 http://www.ubuntu.com/usn/USN-1001-1 http://www.vupen.com/english/advisories/2010/1944 https://bugzilla.redhat.com/show_bug.cgi?id=614248 https://exchange.xforce.ibmcloud.com/vulnerabilities/60809 https://rhn.redhat.com/errata/RHSA-2010-0567.html https://rhn.redhat.com/errata/RHSA-2010-0568.html htt • CWE-287: Improper Authentication •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3374 – possible buffer overflow could cause local DoS by crashing cman
https://notcve.org/view.php?id=CVE-2007-3374
Buffer overflow in cluster/cman/daemon/daemon.c in cman (redhat-cluster-suite) before 20070622 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via long client messages. Un desbordamiento de búfer en el archivo cluster/cman/daemon/daemon.c en cman (redhat-cluster-suite) antes del 20070622, permite a usuarios locales causar una denegación de servicio (bloqueo) y posiblemente ejecutar código arbitrario por medio de mensajes de cliente largos. • http://osvdb.org/37497 http://secunia.com/advisories/25799 http://secunia.com/advisories/25818 http://secunia.com/advisories/25886 http://sourceware.org/cgi-bin/cvsweb.cgi/cluster/cman/daemon/daemon.c.diff?cvsroot=cluster&r1=1.34&r2=1.35 http://www.securityfocus.com/bid/24595 http://www.securitytracker.com/id?1018323 http://www.ubuntu.com/usn/usn-476-1 https://exchange.xforce.ibmcloud.com/vulnerabilities/35034 https://launchpad.net/bugs/121780 https://oval.cisecurity& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3373
https://notcve.org/view.php?id=CVE-2007-3373
daemon.c in cman (redhat-cluster-suite) before 20070622 does not clear a buffer for reading requests, which might allow local users to obtain sensitive information from previous requests. El archivo daemon.c en cman (redhat-cluster-suite) antes del 20070622, no limpia un búfer para las peticiones de lectura, lo que podría permitir a usuarios locales obtener información confidencial de peticiones anteriores. • http://osvdb.org/45381 https://exchange.xforce.ibmcloud.com/vulnerabilities/35152 https://www.redhat.com/archives/cluster-devel/2007-June/msg00130.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •