-
Notifications
You must be signed in to change notification settings - Fork 0
/
java_cve.json
2582 lines (2239 loc) · 156 KB
/
java_cve.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/* http://www.gnu.org/licenses/fdl.html
Copyright (C) 2012-2017 Basile Chandesris.
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3
or any later version published by the Free Software Foundation;
with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
A copy of the license is included in the section entitled
"GNU Free Documentation License".
# LISTS
http://www.cvedetails.com/vulnerability-list/cvssscoremin-9/cvssscoremax-10/vulnerabilities.html
http://cert.europa.eu/cert/newsletter/en/latest_Security%20Bulletins_.html
http://www.sonarsource.org/sonar-to-identify-security-vulnerabilities/
https://www.owasp.org/index.php/Top_10_2010-Main owasp,netsec,webapp,risks,W
http://osdir.com/ml/bugtraq.security/2012-04/ vul,source
https://cassandra.cerias.purdue.edu/CVE_changes/
https://vigilance.fr/
https://support.springsource.com/security_alerts
https://support.springsource.com/eol
https://github.com/victims/victims-cve-db
# ARTICLES
https://www.owasp.org/index.php/OWASP_Dependency_Check
https://www.owasp.org/images/7/70/ASDC12-The_Unfortunate_Reality_of_Insecure_Libraries.pdf
http://www.esecurityplanet.com/trends/article.php/3735216/Feel-Vulnerable-Time-for-Vulnerability-Management-Tools.htm
http://seclists.org/fulldisclosure/2014/May/55 vulnerability management
http://blog.corsaire.com/2014/06/02/why-infrastructure-vulnerability-assessments-are-important/
https://www.securecoding.cert.org/confluence/display/jg/Java+Coding+Guidelines
http://stackoverflow.com/questions/17671899/when-is-java-6-end-of-life-in-the-context-of-writing-developer-tools
# TOOLS
https://www.owasp.org/index.php/OWASP_Dependency_Check
https://github.com/OSSIndex/ossindex-maven-plugin
http://jeremylong.github.io/DependencyCheck/dependency-check-maven/usage.html
https://groups.google.com/forum/?fromgroups#!forum/dependency-check
http://jeremylong.github.io/DependencyCheck/suppression.html
https://github.com/jeremylong/DependencyCheck/blob/master/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java
mvn dependency:tree
mvn versions:display-dependency-updates
<reporting>
<plugins>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>versions-maven-plugin</artifactId>
<version>2.1</version>
<reportSets>
<reportSet>
<reports>
<report>dependency-updates-report</report>
<report>plugin-updates-report</report>
<report>property-updates-report</report>
</reports>
</reportSet>
</reportSets>
</reporting>
http://stackoverflow.com/questions/2687220/maven-check-for-updated-dependencies-in-repository
https://github.com/jeremylong/DependencyCheck
https://github.com/victims redhat
http://vimeo.com/93186243
http://code.google.com/p/six-oval/
http://juliusdavies.ca/2013/j.emse/bertillonage/
https://github.com/olukas/pro-grade Java Security Policy with denying rules
https://staff.aist.go.jp/nakamura-akihito/six/vuln/index.html
https://code.google.com/p/forbidden-apis/wiki/MavenUsage
http://vongosling.github.io/dependency-mediator/
https://github.com/timgifford/maven-buildtime-extension
# VERSION SYSTEMS
http://apr.apache.org/versioning.html
https://github.com/netty/netty/issues/1269
http://www.javacodegeeks.com/2014/02/version-numbering-scheme-yet-another-approach.html?ModPagespeed=noscript
https://gist.github.com/laughinghan/009e300626f328792815
http://bnd.bndtools.org/chapters/170-versioning.html osgi
http://mvnrepository.com/popular
# ANALIZERS
https://developers.google.com/java-dev-tools/codepro/doc/?hl=fr
http://findbugs.sourceforge.net/
http://pmd.sourceforge.net/
http://h3xstream.github.io/find-sec-bugs/
https://github.com/SonarQubeCommunity/sonar-findbugs
https://github.com/amaembo/huntbugs
https://github.com/selesse/jxlint java static analysis
http://fbinfer.com/
https://github.com/facebook/infer/tree/master/infer/src/backend ocaml/python
http://stackoverflow.com/questions/27291969/mapping-my-code-from-ocaml-f-to-scala-some-questions
http://sable.github.io/soot/
http://wala.sourceforge.net/wiki/index.php/Main_Page
http://apache-tapestry-mailing-list-archives.1045711.n5.nabble.com/OT-Any-static-code-analysis-tool-td5728699.html
https://github.com/google/error-prone JDK 8
http://errorprone.info/bugpatterns
--
http://codegolf.stackexchange.com/questions/28786/write-a-program-that-makes-2-2-5
# OTHERS OPEN JAVA SECURITY TOOLS
https://github.com/simmel/SecurerString
http://tersesystems.com/2014/03/02/monkeypatching-java-classes/
http://www.aspectsecurity.com/tools/javasnoop
https://github.com/coverity/coverity-security-library/tree/develop/coverity-escapers html escape
# QUESTIONS/ANSWERS
http://stackoverflow.com/questions/10675804/are-hibernate-queries-vulnerable-to-sql-injection
http://stackoverflow.com/questions/398179/findbugs-not-finding-potential-sql-injection-vulnerability
http://stackoverflow.com/questions/19119751/java-keytool-the-security-of-generated-keys-with-java-in-general
http://www.javacodegeeks.com/2013/08/getting-application-security-vulnerabilities-fixed.html?ModPagespeed=noscript
http://security.stackexchange.com/questions/20095/vulnerable-java-applications
https://www.owasp.org/index.php/Securing_tomcat
http://h3xstream.github.io/find-sec-bugs/bugs.htm
http://benmmurphy.github.io/blog/2015/10/21/zdi-13-075-2013-java-1-dot-7-0-09-sandbox-bypass/
=======================================================================
TODO Classification backlog ongoing...
Apache Foundation
http://vigilance.fr/vulnerabilities/Apache-log4j-537000
https://issues.apache.org/bugzilla/show_bug.cgi?id=50323
http://apache-logging.6191.n7.nabble.com/DO-NOT-REPLY-Bug-50323-New-Vulnerability-in-NTEventLogAppender-td15519.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2067 Apache Tomcat
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2071 -> 6.0.37 / 7.0.40
http://www.securityfocus.com/bid/59798 Apache Tomcat CVE-2013-2071 Information Disclosure Vulnerability
http://xforce.iss.net/xforce/xfdb/49213 tomcat,vul,2009
http://osvdb.org/show/osvdb/90565 tomcat,vul
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=423435 CVE-2007-1858: insecure default SSL cipher configuration in Apache Tomcat
http://osvdb.org/show/osvdb/78331 vul,tomcat
http://osvdb.org/show/osvdb/78573 vul,tomcat
http://www.securityfocus.com/bid/60186/info Apache Tomcat CVE-2013-1976 Insecure Temporary File Handling Vulnerability
http://mail-archives.apache.org/mod_mbox/tomcat-announce/201109.mbox/%3C4E805D2E.8010401@apache.org%3E CVE-2011-1184 Apache Tomcat - Multiple weaknesses in HTTP DIGEST authentication
http://www.securityfocus.com/bid/26070 Apache Tomcat WebDav Remote Information Disclosure Vulnerability
http://www.securityfocus.com/bid/46164 Apache Tomcat NIO Connector Denial of Service Vulnerability
org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.
http://markmail.org/search/?q=list%3Aorg.apache.announce/#query:list%3Aorg.apache.announce%2F+page:1+mid:bvdiolcmddjfmx45+state:results vul,cloudstack
http://seclists.org/fulldisclosure/2013/Feb/39 cxf,vul
http://markmail.org/search/?q=list%3Aorg.apache.announce/#query:list%3Aorg.apache.announce%2F+page:4+mid:zqmqwmhcf5exvf6f+state:results archiva,vul
http://www.cvedetails.com/cve/CVE-2013-2160/ Apache-CXF.html
https://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc
http://mail-archives.apache.org/mod_mbox/www-announce/201402.mbox/%3CCALvzYd-mcX-YJsP1N3wK7wWkgGg_i_5%2B-wMq%3D%3DNU2OMK7yKcvA%40mail.gmail.com%3E CVE-2014-0002 and CVE-2014-0003 - Apache Camel critical disclosure vulnerability
http://osvdb.org/show/osvdb/84231 hadoop > 2.0.1-alpha
http://osvdb.org/show/osvdb/80981 vul,hadoop
http://mail-archives.apache.org/mod_mbox/hadoop-general/201308.mbox/%3CCA+4052kX8oqCeWFYeQ46LhrpYunE0vMu5Bmw-OidN9DPQMzzfw@mail.gmail.com%3E
CVE-2013-2192: Apache Hadoop Man in the Middle Vulnerability
http://www.cvedetails.com/cve/CVE-2013-2192/ apache hadoop
http://osvdb.org/show/osvdb/78903 vul,cxf
http://camel.apache.org/camel-272-release.html xss,vul,camel
http://struts.apache.org/release/2.2.x/docs/version-notes-221.html
http://osvdb.org/show/osvdb/78276 vul,struts
http://osvdb.org/show/osvdb/78108 vul,struts
http://osvdb.org/show/osvdb/78109 vul,struts
http://osvdb.org/show/osvdb/78993 vul,struts
http://osvdb.org/show/osvdb/78990 vul,struts
http://www.scip.ch/fr/?vuldb.12291 struts CVE-2012-0394
http://seclists.org/fulldisclosure/2014/Mar/44 [ANN] Struts 2.3.16.1 GA release available - security fix
http://seclists.org/fulldisclosure/2014/Apr/250 vul,struts
http://packetstormsecurity.com/files/119530/Apache-CouchDB-1.0.3-1.1.1-1.2.0-Information-Disclosure.html
http://lucene.472066.n3.nabble.com/jira-Created-SOLR-74-Cross-site-scripting-vulnerabilities-td508803.htmls
https://issues.apache.org/jira/browse/SOLR-1031
https://groups.google.com/forum/#!topic/ajax-solr/ELR8_M4d-uE
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731113
http://tiles.apache.org/framework/security/security-bulletin-1.html
https://issues.apache.org/jira/browse/SHINDIG-906 vul,shindig
http://osvdb.org/show/osvdb/79002 vul,myface
http://ofbiz.apache.org/download.html#vulnerabilities
http://osvdb.org/show/osvdb/81196 vul,ofbiz http://mail-archives.apache.org/mod_mbox/ofbiz-dev/201204.mbox/%3CA126EDA0-06A5-4B67-8CDD-FC5F5AABA147@apache.org%3E
https://blogs.reucon.com/srt/vulnerability-in-apacheds-1-5-10878/ vul,apacheds,ldap
http://mail-archives.apache.org/mod_mbox/portals-jetspeed-dev/200703.mbox/%3C45E8A22A.3050404@douma.nu%3E jetsepeed,vul
http://www.cvedetails.com/cve/CVE-2006-2806/ james,apache
http://www.cvedetails.com/cve/CVE-2004-2650/
http://avalon.apache.org/closed.html EOL
http://excalibur.apache.org/framework/ org.apache.avalon
https://issues.apache.org/jira/browse/OFBIZ-1959 2010
http://ofbiz.apache.org/download.html ofbiz CVE
https://github.com/apache/roller/commit/e7cae713115677906436086e8c39f3e641a609c4
https://github.com/apache/roller/commit/de93d37061ddb3ca61b8ca9b922c8cd61a67d3bf
http://commons.apache.org/proper/commons-betwixt/betwixt-0.8/docs/index.html Not Found
http://commons.apache.org/proper/commons-validator/changes-report.html - oro EOL dependency removed => 1.4
https://issues.apache.org/jira/browse/AXIOM-407 Woodstox 3.2.x is no longer maintained: EOL => 4.1
woodstox:wstx
http://secunia.com/community/advisories/10064
http://cocoon.10839.n7.nabble.com/Fwd-SECURITY-Frame-injection-vulnerability-in-published-Javadoc-td57989.html
https://issues.apache.org/jira/browse/COCOON-487
http://www.cirt.net/Apache%20Cocoon%20Path%20Disclosure
http://www.cvedetails.com/vulnerability-list/vendor_id-45/product_id-6846/Apache-Derby.html
https://issues.apache.org/jira/browse/AMQ-4115
http://osvdb.org/92997 common codec -> 1.4 (https://issues.apache.org/jira/browse/CODEC-70)
https://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txt
https://issues.apache.org/jira/browse/WSS/fixforversion/12325595 wss4j -> 1.6.14
http://vigilance.fr/vulnerabilities/Apache-log4j-537000
http://osvdb.org/show/osvdb/102880 2014-01-28 Apache Axis2
http://osvdb.org/show/osvdb/102786 2014-01-07 Apache Santuario
http://apache-xml-project.6118.n7.nabble.com/Re-IMPORTANT-Vulnerability-issue-CVE-2009-2625-td2673.html xerces2.10.0
http://vigilance.fr/vulnerability/Apache-Xerces2-Java-Java-JRE-JDK-OpenJDK-memory-corruption-via-XML-8925
https://lists.debian.org/debian-security-announce/2010/msg00021.html http://comments.gmane.org/gmane.text.xml.xerces-j.user/5147
https://bugzilla.redhat.com/show_bug.cgi?id=824075
http://jira.codehaus.org/browse/REDBACK-276 http://archiva.apache.org/redback/
http://apache-tapestry-mailing-list-archives.1045711.n5.nabble.com/Vulnerability-Scanners-td5503278.html
https://issues.apache.org/jira/browse/TAP5-1057 TAP5-1442
http://apache-tapestry-mailing-list-archives.1045711.n5.nabble.com/XSS-vulnerability-in-calendar-component-td2433878.html
https://issues.apache.org/jira/browse/HBASE-5598
http://attic.apache.org/
http://commons.apache.org/dormant.html
http://esme.apache.org/ EOL
https://issues.apache.org/jira/secure/BrowseProjects.jspa#10220 retired
http://www.apache.org/dist/tika/CHANGES-1.4.txt Release 0.3 - 03/09/2009
* Tika now disables the loading of all external entities in XML files
that it parses as input documents. This improves security and avoids
problems with potentially broken references. (TIKA-185)
http://mail-archives.apache.org/mod_mbox/www-announce/201404.mbox/%3C534CE273.9020601%40apache.org%3E
http://mail-archives.apache.org/mod_mbox/www-announce/201404.mbox/%3C833AEE81-D6D3-485D-A568-45567BBD48CD%40apache.org%3E archiva
http://mail-archives.apache.org/mod_mbox/www-announce/201404.mbox/%3CA6832E37-6DF3-4738-B96B-133362F67049%40apache.org%3E
Others-
Springs Framework
http://support.springsource.com/security/springsource-all
http://sourceforge.net/mailarchive/forum.php?thread_name=100F37D3A283C749B712FC0923D7AB5B08C825BA%40glamsg58.europe.jacobs.com&forum_name=geoserver-devel
http://www.securityfocus.com/bid/56408
http://archives.neohapsis.com/archives/fulldisclosure/current/0011.html spring
http://seclists.org/fulldisclosure/2013/Nov/14
https://jira.springsource.org/browse/SEC-1285 minor vulnerability in BasicProcessingFilter
http://osvdb.org/show/osvdb/103965 Java OpenID Server (JOIDS) contains a flaw that allows a remote, user-assisted attacker to conduct a session fixation attack via the 'jsessionid' parameter to the /home script. This flaw exists because the application, when establishing a new session, does not invalidate an existing session identifier and assign a new one. With a specially crafted request fixating the session identifier, a context-dependent attacker can ensure a user authenticates with the known session identifier, allowing the session to be subsequently hijacked.
http://osvdb.org/show/osvdb/103964
http://vigilance.fr/vulnerabilite/TLS-DTLS-obtention-d-information-en-mode-CBC-Lucky-13-12374
http://vigilance.fr/vulnerabilite/Bouncy-Castle-JCE-timing-attack-9349
http://vigilance.fr/vulnerabilite/Bouncy-Castle-contournement-de-TLS-Server-client-auth-14610
https://community.emc.com/thread/168186
http://jira.ow2.org/browse/LEMONLDAP-372
http://osvdb.org/show/osvdb/78454 opennms,vul
https://community.oracle.com/thread/2162450 jsch
http://sourceforge.net/p/jsch/mailman/message/32115165/ JSch 0.1.51 2014-03-18 14:23:32
http://osvdb.org/show/osvdb/98562 Oracle Java JDK / JRE / JRockit Cryptographic Key Classes Private Key Information Disclosure
http://i8jesus.com/?p=255 antisamy org.owasp.antisamy:antisamy 1.5.3
http://lists.owasp.org/pipermail/owasp-antisamy/2013-September/000549.html
http://www.securityfocus.com/bid/63584 OWASP Java Encoder Cross Site Scripting Filter Security Bypass Vulnerability
https://github.com/jline/jline2/issues/85
http://vigilance.fr/vulnerabilite/Jasig-CAS-Server-contournement-de-l-authentification-via-Google-Accounts-Integration-14512
https://issues.jasig.org/browse/CAS-1064
http://jasig.275507.n4.nabble.com/cross-site-scripting-vulnerability-td1570360.html
http://jasig.275507.n4.nabble.com/CAS-3-5-2-1-and-3-4-12-1-Security-Releases-td4662444.html
Framework, major tools builder
http://jira.codehaus.org/browse/JRUBY-4828 vul,jruby
http://wouter.coekaerts.be/2011/vaadin-vulnerabilities vaadin
https://jira.terracotta.org/jira/browse/QTZ-43
http://www.securiteam.com/securitynews/5YP0E15FFQ.html vul,javamail,1.3.2,2005
http://osvdb.org/show/osvdb/79991 freemaker > 2.3.19
http://freecode.com/projects/freemarker/releases/342158
http://freemarker.org/docs/versions_2_3_19.html#v2319secfix
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.7_Technical_Notes/jboss-seam2.html vul,seam
http://osvdb.org/95378 2013-06-30 antlr ->4.1
https://github.com/antlr/antlr4/issues/300
https://github.com/jruby/jruby/issues/732
http://jira.codehaus.org/browse/GROOVY-6210
http://hal.inria.fr/inria-00322138 osgi
http://vmkit.llvm.org/publications/osgi_dsn.html
- Jenkins
CVE-2019-10321/22/23/24 =< Jenkins Artifactory Plugin 3.2.2
CVE-2019-10325/26i =< Jenkins Warnings NG Plugin 5.0.0
CVE-2019-10327 =< XXE Jenkins Pipeline Maven Integration Plugin 1.7.0
CVE-2019-10328 =< Jenkins Pipeline Remote Loader Plugin 1.4
CVE-2019-10329 =< Jenkins InfluxDB Plugin 1.21
CVE-2019-10330 =< Jenkins Gitea Plugin 1.1.1
- Scala
https://play.lighthouseapp.com/projects/57987/tickets/1353-play-124-vulnerable-to-hash-collision-attack vul,play
https://groups.google.com/forum/#!msg/spray-user/snR1lojX3vU/--aMyhhmy3wJ spray vulnerability
http://www.playframework.com/security/vulnerability/20130806-SessionInjection
http://www.playframework.com/changelog Play 2.1.5 Released 20 September 2013 Vulnerabilities fixed 20130920-XmlExternalEntity XML External Entity exploit
http://osvdb.org/show/osvdb/97277 vul,play
Application servers
http://jira.codehaus.org/browse/JETTY-1004
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=527571
http://svn.codehaus.org/xplanner/trunk/leere/ext/jetty-4.2.21/VERSION.TXT
Jetty-4.1.1 - 30 September 2002
+ Fixed client scripting vulnerability with jasper2.
http://blog.imperva.com/2013/11/threat-advisory-a-jboss-as-exploit-web-shell-code-injection.html
http://osvdb.org/show/osvdb/106020 jboss
http://old.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html
ttp://osvdb.org/show/osvdb/98243 2013-08-21 Restlet
http://osvdb.org/show/osvdb/103352 vul,restlet
http://osvdb.org/show/osvdb/94505 2013-06-05 dotCMS
http://osvdb.org/show/osvdb/95503 2013-02-14 openCms
http://code.google.com/p/mybatis/issues/detail?id=683
http://www.hpenterprisesecurity.com/vulncat/en/vulncat/java/sql_injection_ibatis_data_map.html
CMS, ERP, web builder
http://osvdb.org/show/osvdb/78716 atlasian
http://osvdb.org/show/osvdb/79868 vul,jenkins https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05
https://wiki.jenkins-ci.org/display/SECURITY/Home jenkins,security,vul
http://i8jesus.com/?p=102 jforum
http://jforum.net/ http://osvdb.org/show/osvdb/101438 vul,java
http://jira.pentaho.com/browse/BISERVER-6244 pentaho,vul,201106
http://www.cvedetails.com/vulnerability-list/vendor_id-2114/product_id-12592/Liferay-Portal.html
http://seclists.org/fulldisclosure/2015/Oct/13
https://bugs.mageia.org/show_bug.cgi?id=6011
http://www.xssed.com/mirror/54931/ vul,jahia,2008 - http://www.securityfocus.com/bid/5684 2002
https://issues.onehippo.com/browse/HSTTWO-1514 hippo cms,2011,vul
https://jira.exoplatform.org/browse/JCR-403 exo jcr > 1.8 1.9 - 2008 - Access manager vulnerability
http://code.google.com/p/gitblit/issues/detail?id=62
Feb 9, 2012
From the gitblit forum:
Gitblit accept url like
http://example.com/gitblit/;jsessionid=8EB3144A6XXXXXXXXX
and jsessionid doesn't change when user login.
So session fixation seems to be possible.
http://en.wikipedia.org/wiki/Session_fixation
Fixed in v0.9.1
http://www.cvedetails.com/vulnerability-list/vendor_id-3885/Xwiki.html
https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Application_Platform/4.2/html/Release_Notes_CP09/Issues-fixed-in-this-release.html
https://bugs.mageia.org/show_bug.cgi?id=6011
https://bugs.mageia.org/show_bug.cgi?id=8936
http://blog.h3xstream.com/2014/02/jira-path-traversal-explained.html
http://www.xwiki.org/xwiki/bin/view/ReleaseNotes/ReleaseNotesXWiki541 upload fix
http://www.onehippo.org/binaries/content/assets/connect/library/about/hippo-cms-7.6-fixed-issues.txt
HSTTWO-1514] XSS vulnerability in SearchResult class of site-toolkit-core
http://www.scip.ch/fr/?vuldb.12128 java ibm sametime
Others
middleware
http://www.exploit-db.com/exploits/15918/ vul,openfire,2010
https://issues.jboss.org/browse/ESB-1487?_sscc=t Fuse ESB ->3.4
android
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-1243 android,vul,twitrocker2
gaming
http://osvdb.org/show/osvdb/83317 JOGL
http://osvdb.org/show/osvdb/83316 JOGL JOAL
http://cuthbert.sixgun.org/fab/blog/2011/minecraft-vulnerability 21 April, 2011
cloud
http://www.contextis.co.uk/research/blog/dirtydisks/ cloud,rackspace,hosting,vulnerability,20120424,netsec,news
http://seclists.org/fulldisclosure/2014/Jan/192 java cloud
gis
http://osvdb.org/show/osvdb/79376 vul,geomajas
http://www.osvdb.org/show/osvdb/95750
http://jira.codehaus.org/browse/GEOT-1999 2008-09-03 -> 2.5.2, 2.6-M0
to check
http://www.kb.cert.org/vuls/id/625617
http://news.ycombinator.com/item?id=5037904 java,vul
https://webarchive.jira.com/browse/HER-1122?page=com.atlassian.streams.streams-jira-plugin:activity-stream-issue-tab heritrix
https://issues.apache.org/bugzilla/show_bug.cgi?id=53603
http://osvdb.org/show/osvdb/78471 emc
http://osvdb.org/show/osvdb/89452
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-0177
http://seclists.org/fulldisclosure/2013/Jan/148
http://osvdb.org/show/osvdb/89453
http://osvdb.org/show/osvdb/89293
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-5641
https://bugzilla.redhat.com/show_bug.cgi?id=783898
http://cert.europa.eu/static/SecurityAdvisories/CERT-EU-SA2012-0058.txt - oracle
http://seclists.org/bugtraq/2012/Apr/133
http://seclists.org/bugtraq/2012/Apr/203
http://lists.forgerock.org/pipermail/openam/2011-July/002434.html
http://www.reddit.com/r/netsec/comments/syqki/eclipse_projects_autobuild_on_import_executes/ eclipse,vul,autobuild,makefile
http://www.securityfocus.com/bid/17270 2006,blazix,vul
http://www.mail-archive.com/dspace-tech@lists.sourceforge.net/msg12809.html vul,dspace,201012
http://www.cvedetails.com/vulnerability-list/cvssscoremin-9/cvssscoremax-10/vulnerabilities.html
http://osdir.com/ml/bugtraq.security/2012-04/ vul,source
http://maven.40175.n5.nabble.com/Nexus-2-0-4-Released-td5666139.html vul,xss,nexus
http://www.cvedetails.com/vulnerability-list/vendor_id-45/cvssscoremin-7/cvssscoremax-7.99/Apache.html
https://jira.kuali.org/browse/KULRICE-2920 kuali rice > rice 1.0 - Fix XSS vulnerability in question framework.d
http://jira.ow2.org/browse/WEBLAB-405?page=com.atlassian.jira.plugin.ext.bamboo%3Abamboo-build-results-tabpanel
http://osvdb.org/show/osvdb/101169
http://osvdb.org/show/osvdb/101187
http://osvdb.org/show/osvdb/101114
http://osvdb.org/show/osvdb/100657
http://osvdb.org/show/osvdb/100367
http://osvdb.org/show/osvdb/99375
http://osvdb.org/show/osvdb/99047
http://osvdb.org/show/osvdb/100378 http://osvdb.org/show/osvdb/100379
http://osvdb.org/show/osvdb/98460
http://osvdb.org/show/osvdb/98462
http://osvdb.org/show/osvdb/98524
https://groups.google.com/forum/#!topic/adf-methodology/S0Rlu3Ad4oQ
https://bugzilla.redhat.com/show_bug.cgi?id=873252
http://www.securityfocus.com/bid/50218 vul, java rhino js
http://osvdb.org/97778
https://code.google.com/p/javamelody/issues/detail?id=346
https://www.projectforge.org/jira/browse/PF-485
http://www.projectforge.org/pf-en/News
https://issues.apache.org/jira/browse/WW-3264
https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-08-28
http://jira.grails.org/browse/WEBSITE-268
http://www.scip.ch/en/?vuldb.10702
http://osvdb.org/show/osvdb/98460
https://bugzilla.redhat.com/show_bug.cgi?id=799078
https://tools.codice.org/jira/browse/DDF-81
https://lists.fedoraproject.org/pipermail/java-sig-commits/2013-March/009353.html
https://jawr.java.net/security issue => Version 3.2 released
http://www.redhat.com/archives/rhsa-announce/2013-December/msg00004.html
PLEASE NOTE: We changed the MX4JSystemManager to NoopSystemManager
because of the vulnerability described here:
http://issues.apache.org/bugzilla/show_bug.cgi?id=17241
Furthermore, commenting out the whole block you get an exception:
org.apache.avalon.framework.service.ServiceException: Unable to provide
implementation for org.apache.avalon.phoenix.interfaces.SystemManager
(Role='org.apache.avalon.phoenix.interfaces.SystemManager')]
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html java 7u51
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
http://www.oracle.com/technetwork/java/javase/jdk7-relnotes-418459.html
https://code.google.com/p/guava-libraries/issues/detail?id=1635
http://developer.berlios.de/forum/forum.php?forum_id=39216 java vul
https://forum.hibernate.org/viewtopic.php?p=2454336
https://plus.google.com/+googleguava/posts/ZAhULZfxUhm Guava 16.0.1 released
https://issues.apache.org/jira/browse/JCLOUDS-427 Upgrading JDK from 1.7.0_45 to 1.7.0_51 causes problems when searching for interface implementations
http://osvdb.org/show/osvdb/102273 2014-01-16 InMobi Ad SDK
http://osvdb.org/show/osvdb/99549
http://osvdb.org/show/osvdb/97408
http://osvdb.org/show/osvdb/95502
http://seclists.org/fulldisclosure/2014/Feb/38
http://seclists.org/fulldisclosure/2014/Feb/41
http://xerces.apache.org/xerces-j/ EOL (Hibernated Projects - http://xerces.apache.org/)
http://osvdb.org/show/osvdb/103603 solr
http://osvdb.org/show/osvdb/102570 JAMon
http://osvdb.org/show/osvdb/105385 drools vul
http://www.cvedetails.com/cve/CVE-2012-0032/ Red Hat JBoss Operations Network (JON)
http://mail.openjdk.java.net/pipermail/lambda-dev/2014-March/011940.html java8
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA
http://osvdb.org/show/osvdb/106477
http://vigilance.fr/vulnerabilite/Openfire-Cross-Site-Scripting-de-Admin-Console-14696
http://www.debian.org/security/2014/dsa-2912 openjdk6
http://www.cert.ssi.gouv.fr/site/CERTFR-2014-ALE-004/index.html
http://blog.fuseyism.com/index.php/2014/04/16/security-icedtea-2-4-7-for-openjdk-7-released/
http://blog.fuseyism.com/index.php/2014/04/15/security-icedtea-1-13-3-for-openjdk-6-released/
http://osvdb.org/show/osvdb/106279 jruby
http://cert.europa.eu/static/SecurityAdvisories/CERT-EU-SA2013-0065.txt jboss soa
http://sites.univ-provence.fr/wcri/d_serv/d_reseau/d_cert/2013/certmsgVULN280 jboss brmns
http://seclists.org/oss-sec/2011/q2/188 http client
http://apigee.com/docs/api-services/content/minimize-vulnerabilities-using-jsonthreatprotection
http://stefanhendriks.wordpress.com/2011/02/16/prevent-cross-site-scripting-when-using-json-objects-using-esapi-and-jackson-framework-1-7-x/
http://osvdb.org/show/osvdb/106564
http://osvdb.org/show/osvdb/106572
http://mail-archives.apache.org/mod_mbox/www-announce/201402.mbox/%3C52F373FC.9030907%40apache.org%3E
https://issues.apache.org/jira/browse/TAP5-1005
http://apache-tapestry-mailing-list-archives.1045711.n5.nabble.com/change-session-id-after-login-td3217239.html
https://issues.apache.org/jira/browse/TAP5-2291
http://apache-tapestry-mailing-list-archives.1045711.n5.nabble.com/Tapestry-with-Jetty-behind-https-frontend-td5725854.html#a5725896 Tomcat 7.0.52(51)
Fix CVE-2014-0050
http://osvdb.org/show/osvdb/105895 lcms -> java,openjdk http://www.debian.org/security/2014/dsa-2923
http://osvdb.org/show/osvdb/102880 axis
https://issues.jboss.org/browse/AS7-4747
https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
https://code.google.com/p/owaspantisamy/issues/detail?id=102
http://www.les7arts.com/DependencyCheck-Report.html ofbiz
https://issues.liferay.com/secure/ConfigureReleaseNote.jspa?projectId=10952&version=11326
http://sourceforge.net/projects/soapui/files/soapui/5.0.0/ soap ui
http://jersey.576304.n2.nabble.com/SAX-Feature-error-in-Jersey-1-1-4-1-td4581700.html jersey
http://archive.gria.org/docs/services/4.3.1/docs/change-log.html wss4j
http://markmail.org/message/4nefnhawjrcdxpfr
http://nicklothian.com/blog/2006/12/12/rome-09-released/
http://advisories75.rssing.com/chan-6966477/latest.php
http://vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf xerces
http://seclists.org/fulldisclosure/2014/May/93 opencms
http://osvdb.org/show/osvdb/71873 IBM Tivoli Monitoring contains an unspecified flaw related to the bundled version of Java that may allow an attacker to have an unspecified impact. No further details have been provided.
http://osvdb.org/show/osvdb/80616 Zend Server contains a flaw related to the Java Bridge component that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'directives[zend_jbridge.encoding]' parameter upon submission to the program. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.
http://osvdb.org/show/osvdb/99549 OWASP java encoder XSS
OWASP Java Encoder contains a flaw that is due to Internet Explorer treating accent grave (`) as a delimiter character. This may allow an attacker to bypass filters and conduct a cross-site scripting attack.
http://osvdb.org/show/osvdb/88541 International Components for Unicode for Java (ICU4J) contains a flaw related to the TimeZone.java file. While a cursory review of the code commit does not suggest a security fix, the note with this specifically indicates it fixes a security bug. No further details are available.
http://bugs.icu-project.org/trac/changeset/2929
http://osvdb.org/show/osvdb/72940 Libvoikko Python / Java Interface NULL Character Handling DoS
Upgrade to version 3.2.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
http://voikko.puimula.org/releases.html
http://osvdb.org/show/osvdb/89544 Barracuda SSL VPN contains a flaw that is due to the setSysProp.jsp script allowing unauthenticated users to manipulate Java system properties. With a specially crafted request, a remote attacker can change values for arbitrary Java system properties, which may disable access restrictions for the application programming interface (API). This will allow the attacker to cause a denial of service for the system, change administrator passwords, download configuration files and database dumps, and possibly have other unspecified impacts.
http://osvdb.org/show/osvdb/103221 Cisco Unified Communications Manager contains a flaw that may allow carrying out an SQL injection attack. The issue is due to the Java interface not properly sanitizing user-supplied input before using it in SQL queries. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
http://osvdb.org/show/osvdb/15644 JavaMail API Content-Disposition Directory Traversal - Directory traversal vulnerability in the MimeBodyPart.getFileName method in JavaMail 1.3.2 allows remote attackers to write arbitrary files via a .. (dot dot) in the filename in the Content-Disposition header.
http://osvdb.org/show/osvdb/102252 xstream
http://osvdb.org/show/osvdb/32979 apache james
http://osvdb.org/show/osvdb/40548 hsqldb
http://osvdb.org/show/osvdb/63874 Tiny Java Web Server (TJWS) Unspecified Traversal Arbitrary Directory / File Access
http://osvdb.org/show/osvdb/107028 IBM WebSphere Portal contains a flaw related to unvalidated JSP includes that is triggered when handling a specially crafted URL request. This may allow a remote attacker to gain access to potentially sensitive information, consume memory resources, or control the request dispatcher on the web server.
http://www.aspose.com/corporate/purchase/policies/discontinued-products.aspx EOL
http://mail-archives.apache.org/mod_mbox/www-announce/201405.mbox/%3CCALGG8z0JiKbKdat85ssdwQi0NUuKzF5Ma-wNYwWxh6hKPgSZpg%40mail.gmail.com%3E eol
http://osvdb.org/show/osvdb/107246 Perseus Java Hopper contains a flaw that allows a cross-site scripting (XSS) attack. This flaw exists because the /hopper/morph script does not validate input to the 'l' GET parameter before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
http://vigilance.fr/vulnerabilite/Apache-Struts-1-execution-de-code-via-ClassLoader-14799
http://markmail.org/message/bsdeufp23k6nlka5 tomcat
http://markmail.org/message/wehqwlcx47psi7pm
http://markmail.org/message/jzhu4d2sel64lohx
http://markmail.org/message/diqkagq7wuycbfjz
http://www.cert.ssi.gouv.fr/site/CERTFR-2014-AVI-243/index.html
http://seclists.org/fulldisclosure/2014/May/140
http://osvdb.org/show/osvdb/107454
http://osvdb.org/show/osvdb/25677
http://osvdb.org/show/osvdb/104897 alfresco
http://osvdb.org/show/osvdb/104389 spring
http://rpmfind.net/linux/RPM/mandriva/2010.1/x86_64/media/main/updates/eclipse-ecj-3.4.2-0.2.3.1mdv2010.2.x86_64.html
https://jira.exoplatform.org/browse/ECMS-5016 exo
http://osvdb.org/show/osvdb/106579 JSF 2014-03-12
https://jira.atlassian.com/browse/CONF-33729
https://jira.atlassian.com/browse/CONF-33515 struts
https://jira.atlassian.com/browse/CONF-30240
https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2014-05-21
http://collab.sakaiproject.org/pipermail/sakai-dev/2010-August/008735.html
http://www.apereo.org/content/cve-2010-4476-cas-affecting-tomcat-header-parsedouble-dos-vulnerability-advisory java
http://osvdb.org/show/osvdb/58743 WICKET 2007-02-07 https://issues.apache.org/jira/browse/WICKET-260
http://osvdb.org/show/osvdb/107634 2014-05-30 Apache Traffic Server
http://osvdb.org/show/osvdb/107409 2014-05-20 solr
http://osvdb.org/show/osvdb/105923 2014-04-14 zookeeper
https://java.net/jira/browse/JERSEY-2231 sun.net.http.allowRestrictedHeaders=true should be on by default
http://stackoverflow.com/questions/6056125/why-does-content-length-http-header-field-use-a-value-other-than-the-one-given-i
http://www.cvedetails.com/cve/CVE-2011-1322/ saaj ibm
https://issues.apache.org/jira/browse/VELOCITY-849
http://www.cvedetails.com/cve/CVE-2014-3960/ openms
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl
http://www.debian.org/security/2014/dsa-2950
https://rhn.redhat.com/errata/RHSA-2014-0625.html
https://lists.fedoraproject.org/pipermail/announce/2014-June/003216.html
http://vigilance.fr/vulnerabilite/OpenSSL-man-in-the-middle-via-ChangeCipherSpec-14844
http://vigilance.fr/vulnerabilite/OpenSSL-deni-de-service-via-DTLS-Recursion-14845
http://vigilance.fr/vulnerabilite/OpenSSL-deni-de-service-via-ECDH-14847
http://osvdb.org/show/osvdb/107732
http://osvdb.org/show/osvdb/107730
http://osvdb.org/show/osvdb/107731
http://osvdb.org/show/osvdb/107729
http://jvn.jp/en/jp/JVN61247051/index.html
https://www.imperialviolet.org/2014/06/05/earlyccs.html google
https://securityblog.redhat.com/2014/06/05/openssl-mitm-ccs-injection-attack-cve-2014-0224/
http://seclists.org/fulldisclosure/2014/Jun/25
Mojarra 2.2.7 released https://java.net/jira/secure/ReleaseNote.jspa?projectId=10204&version=16868
https://java.net/jira/browse/JAVASERVERFACES-3204
http://mail-archives.apache.org/mod_mbox/shiro-dev/201405.mbox/%3CJIRA.12465307.1274733244761.367826.1400244868942@arcas%3E
http://mail-archives.apache.org/mod_mbox/shiro-dev/201404.mbox/%3CJIRA.12711468.1398866754726.206682.1398868395337@arcas%3E
http://osvdb.org/show/osvdb/107916
http://osvdb.org/show/osvdb/107534
http://osvdb.org/show/osvdb/106409 struts
http://seclists.org/fulldisclosure/2014/Jun/79 jvm
http://www.debian.org/security/2014/dsa-2963 solr
http://jacquesmattheij.com/the-several-million-dollar-bug http async
http://www.cvedetails.com/cve/CVE-2014-4193/ The TLS implementation in EMC RSA BSAFE-Java Toolkits (aka Share for Java) supports the Extended Random extension during use of the Dual_EC_DRBG algorithm, which makes it easier for remote attackers to obtain plaintext from TLS sessions by requesting long nonces from a server, a different issue than CVE-2007-6755.
http://www.cvedetails.com/cve/CVE-2014-4161/ sap
http://www.cvedetails.com/cve/CVE-2014-2609/ HP Executive Scorecard java glassfish
http://osvdb.org/show/osvdb/108269 JClouds
http://osvdb.org/show/osvdb/108077 Hive
http://osvdb.org/show/osvdb/107634 Apache Traffic Server
https://java.net/jira/browse/SERVLET_SPEC-70
http://www.baeldung.com/servlet-session-timeout
http://shiro-developer.582600.n2.nabble.com/Issue-contribution-discussion-review-commit-td7578178.html shiro ldap integration
http://ofbiz.apache.org/ sec
http://svn.apache.org/repos/asf/shiro/board/2014-03.txt
https://rhn.redhat.com/errata/RHSA-2008-0158.html
https://issues.apache.org/jira/browse/SMXCOMP-611
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140709-struts2?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Apache%20Struts%202%20Command%20Execution%20Vulnerability%20in%20Multiple%20Cisco%20Products&vs_k=1
http://vigilance.fr/vulnerability/Apache-Tomcat-denial-of-service-via-Chunked-14806
http://www.securityfocus.com/bid/68678 apache
http://www.securityfocus.com/bid/50211/references
http://www.securityfocus.com/bid/66908/info
http://seclists.org/fulldisclosure/2014/Aug/80 java hive
http://www.securityfocus.com/bid/68678/info
http://httpd.apache.org/security/vulnerabilities_24.html
http://seclists.org/fulldisclosure/2014/Jul/114
https://community.qualys.com/thread/13504
http://osvdb.org/show/osvdb/110377 Not-Yet-Commons-SSL
http://osvdb.org/show/osvdb/110257
http://osvdb.org/show/osvdb/110349 SAP Java
http://osvdb.org/show/osvdb/110350
http://www.securityfocus.com/bid/67121 struts
http://osvdb.org/show/osvdb/11041 Java 2 Micro Edition (J2ME)
http://osvdb.org/show/osvdb/110473 uPortal
http://www.debian.org/security/2014/dsa-2940 struts2
https://marc.info/?l=oss-security&m=140843709911151&w=2
https://marc.info/?l=oss-security&m=140837842125695&w=2
https://marc.info/?l=oss-security&m=140670420127765&w=2
https://marc.info/?l=oss-security&m=140478607419928&w=2
https://marc.info/?l=oss-security&m=140473086930695&w=2
https://marc.info/?l=oss-security&m=140230546422929&w=2
https://marc.info/?l=oss-security&m=140237318614479&w=2
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10642 java jsse updates
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10643 java jsse updates
http://www.cert.ssi.gouv.fr/site/CERTFR-2014-AVI-365/index.html jboss
https://bugs.openjdk.java.net/browse/JDK-8051012
http://www.theregister.co.uk/2014/08/05/java_8u11_breaks_dev_tools/
http://seclists.org/fulldisclosure/2014/Aug/48
http://secpod.org/blog/?p=342 activemq
http://osvdb.org/show/osvdb/92976
https://issues.apache.org/jira/browse/AMQ-4397
http://osvdb.org/show/osvdb/102253 xstream
http://osvdb.org/show/osvdb/102252
http://ofbiz.apache.org/download.html#vulnerabilities
http://vigilance.fr/vulnerabilite/IBM-WebSphere-8-5-multiples-vulnerabilites-15205
http://seclists.org/fulldisclosure/2014/Sep/33 jre update vsphere
http://blog.ivanristic.com/2014/09/sha1-deprecation-what-you-need-to-know.html
https://www.hkcert.org/my_url/en/alert/14091101
http://securitytracker.com/id/1030834
https://www.cert-bund.de/advisoryshort/CB-K14-1131
selenium hudsuck.exe
http://vigilance.fr/vulnerabilite/Apache-Tomcat-upload-de-fichier-via-JSP-15327
http://osvdb.org/show/osvdb/111266
http://osvdb.org/show/osvdb/109394
http://osvdb.org/show/osvdb/110910
http://osvdb.org/show/osvdb/110910 openkm
http://osvdb.org/show/osvdb/108515 glassfish
http://osvdb.org/show/osvdb/103373 mojarra
http://vigilance.fr/vulnerabilite/IBM-WebSphere-MQ-non-filtrage-de-CHLAUTH-15458
http://osvdb.org/show/osvdb/112483 SpagoBI contains a flaw that is due to the missing FEATURE_SECURE_PROCESSING setting. The issue is triggered when handling an XSL document. With a specially crafted XSL document with embedded Java code, a remote attacker can execute arbitrary Java code.
http://seclists.org/fulldisclosure/2014/Oct/71 Oracle ADF JSF
http://vigilance.fr/vulnerabilite/IBM-WebSphere-AS-7-0-multiples-vulnerabilites-15465
http://osvdb.org/show/osvdb/87824 jenkins
http://osvdb.org/show/osvdb/87822
http://osvdb.org/show/osvdb/87299 - ibm java
http://osvdb.org/show/osvdb/86350 - java 2D
http://osvdb.org/show/osvdb/86556 - ofbiz
http://osvdb.org/show/osvdb/113131 JSSE
http://osvdb.org/show/osvdb/113154 WebSphere MQ classes for Java libraries and WebSphere MQ Explorer
http://seclists.org/fulldisclosure/2014/Oct/87
http://www.cvedetails.com/cve/CVE-2014-7296/
http://www.cvedetails.com/cve/CVE-2014-4838/ Cross-site scripting (XSS) vulnerability in GanttProjectSchedulerPopup.jsp in IBM TRIRIGA Application Platform
http://www.cvedetails.com/cve/CVE-2014-4837/
http://www.cvedetails.com/cve/CVE-2014-4836/
http://www.cvedetails.com/cve/CVE-2014-4822/ IBM WebSphere MQ classes for Java libraries 8.0 before 8.0.0.1 and Websphere MQ Explorer
http://www.cvedetails.com/cve/CVE-2014-4289/ Unspecified vulnerability in the JDBC component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2014-6544.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6544 Unspecified vulnerability in the JDBC component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2014-4289.
http://osvdb.org/show/osvdb/113630 VMware vSphere Data Protection contains a flaw related to unspecified Java API calls
http://osvdb.org/show/osvdb/113581 JBoss Keycloak
http://osvdb.org/show/osvdb/113597 GitBlit
http://osvdb.org/show/osvdb/112482 Android contains a flaw related to the addJavascriptInterface() method and the 'accessibility' and 'accessibilityTraversal' objects
http://osvdb.org/show/osvdb/113561 Jersey contains a flaw that is triggered as sensitive information stored in form query parameters may be logged when transferring said parameters
http://osvdb.org/show/osvdb/113139 VT Ldap and Ldaptive contain a flaw in DefaultHostnameVerifier.java
http://osvdb.org/show/osvdb/110203 OpenSAML contains a flaw in the Java and Identity providers in the HttpResource and FileBackedHttpResource implementations
http://osvdb.org/show/osvdb/107849 Cisco Unified Communications Manager (CUCM) contains a flaw that may allow carrying out an SQL injection attack
https://access.redhat.com/security/cve/CVE-2014-6558 It was discovered that the CipherInputStream class implementation in OpenJDK did not properly handle certain exceptions. This could possibly allow an attacker to affect the integrity of an encrypted stream handled by this class.
http://stackoverflow.com/questions/5894994/how-to-disable-calls-to-certain-java-packages-from-jython
http://www.cvedetails.com/cve/CVE-2014-8316/ XML External Entity (XXE) vulnerability in polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate request.
https://access.redhat.com/security/cve/CVE-2014-7169 openjdk jsse
https://access.redhat.com/security/cve/CVE-2014-6517 openjdk
https://access.redhat.com/security/cve/CVE-2014-6457 openjdk jsse triple handshake
https://access.redhat.com/security/cve/CVE-2014-0005 It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.
http://vigilance.fr/vulnerabilite/Mulesoft-Mule-ESB-execution-de-code-15527
https://access.redhat.com/security/cve/CVE-2014-3596 It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
http://www.cvedetails.com/cve/CVE-2014-6562/ Unspecified vulnerability in Oracle Java SE 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
http://www.cvedetails.com/cve/CVE-2014-6512/ Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries.
http://www.cvedetails.com/cve/CVE-2014-4822/ IBM WebSphere MQ classes for Java libraries 8.0 before 8.0.0.1 and Websphere MQ Explorer 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allow local users to discover preconfigured cleartext passwords via an unspecified trace operation.
http://www.cvedetails.com/cve/CVE-2014-4761/ IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 before 8.0.0.1 CF14, and 8.5.0 through 8.5.0.0 CF02 allows remote authenticated users to discover credentials by reading HTML source code.
http://www.cvedetails.com/cve/CVE-2014-4289/ Unspecified vulnerability in the JDBC component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2014-6544.
http://www.cvedetails.com/cve/CVE-2014-3680/ CloudBees Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM.
http://www.cvedetails.com/cve/CVE-2014-3681/ Cross-site scripting (XSS) vulnerability in CloudBees Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
http://www.cvedetails.com/cve/CVE-2014-3679/ The Monitoring plugin before 1.53.0 for CloudBees Jenkins allows remote attackers to obtain sensitive information by accessing unspecified pages.
http://www.cvedetails.com/cve/CVE-2014-7284/ The net_get_random_once implementation in net/core/utils.c in the Linux kernel 3.13.x and 3.14.x before 3.14.5 on certain Intel processors does not perform the intended slow-path operation to initialize random seeds, which makes it easier for remote attackers to spoof or disrupt IP communication by leveraging the predictability of TCP sequence numbers, TCP and UDP port numbers, and IP ID values.
http://cxsecurity.com/cveshow/CVE-2014-6037/ Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0
http://cxsecurity.com/cveshow/CVE-2014-8071/ openmrs
http://cxsecurity.com/cveshow/CVE-2014-8073/
https://www.mail-archive.com/h2-database@googlegroups.com/msg02887.html
http://osvdb.org/show/osvdb/113630 VMware vSphere Data Protection contains a flaw related to unspecified Java API calls.
http://osvdb.org/show/osvdb/113708 SAP NetWeaver AS Java contains an XXE (Xml eXternal Entity) injection flaw that is triggered during the parsing of XML data
http://seclists.org/fulldisclosure/2014/Oct/126 confluence
https://confluence.atlassian.com/display/DOC/Confluence+Security+Overview+and+Advisories
https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2014-05-21
https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17
https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2013-02-21
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00026.html EOL jetty 6 - 2012-01-26
http://lucene.472066.n3.nabble.com/Why-is-Solr-still-shipped-with-Jetty-6-switching-to-Jetty-8-td3986123.html
http://serverfault.com/questions/637649/how-do-i-disable-sslv3-support-in-apache-tomca
http://blog.akquinet.de/2014/10/17/fight-the-poodle-in-jboss-4-and-5-jon-3-and-more/
http://stackoverflow.com/questions/26429751/java-http-clients-and-poodle
http://seclists.org/fulldisclosure/2014/Nov/61 CVE-2014-8349 LIFERAY Portal Stored XSS
http://seclists.org/bugtraq/2014/Nov/52 apache qpid
http://seclists.org/bugtraq/2014/Nov/36 java xml - Apache Santuario XML CVE-2013-2172
http://seclists.org/bugtraq/2014/Oct/14 java xerces-j2 CVE-2013-4002
http://seclists.org/bugtraq/2014/Oct/18 elastic search
http://seclists.org/bugtraq/2014/Sep/181 common upload/tomcat
http://seclists.org/bugtraq/2014/Oct/125 tomcat
http://seclists.org/bugtraq/2014/Sep/59 tomcat
http://seclists.org/bugtraq/2014/Sep/74 tomcat
http://seclists.org/bugtraq/2014/Oct/182 struts
http://seclists.org/bugtraq/2014/Sep/31 jakarta-commons-httpclient
http://seclists.org/bugtraq/2014/Oct/202
http://osvdb.org/show/osvdb/114771 java openkm
https://shibboleth.net/community/news/20141104.html 4 November 2014 Shibboleth Identity Provider V2.4.3, Security Advisory Issued
https://access.redhat.com/security/cve/CVE-2014-7816 undertow
http://markmail.org/message/3ocq7o6zyevduv6q xalan
http://osvdb.org/show/osvdb/114915 liferay
http://osvdb.org/show/osvdb/114955 eclipse Hudson irc
http://osvdb.org/show/osvdb/114960 ManageEngine OpUtils
http://osvdb.org/show/osvdb/113063 DrayTek VigorACS SI
http://osvdb.org/show/osvdb/112126 Google Caja
http://osvdb.org/show/osvdb/110163 Spring Security
http://osvdb.org/show/osvdb/110559 Aerohive HiveManager
http://osvdb.org/show/osvdb/115000 websphere
http://osvdb.org/show/osvdb/115070 RESTEasy contains an XXE (Xml eXternal Entity)
http://osvdb.org/show/osvdb/115076 undertow
http://osvdb.org/show/osvdb/107676 Rocket Servergraph
http://seclists.org/fulldisclosure/2014/Dec/3
http://apache-wicket.1842946.n4.nabble.com/CVE-2014-3526-td4667610.html
http://www.debian.org/security/2014/dsa-3077 openjdk-6
https://www.debian.org/security/2014/dsa-3080 openjdk-7
https://bonita.atlassian.net/browse/BBPMC-189 Bonita Open Solution v5 has reached its end of life
https://confluence.atlassian.com/display/JIRA/End+of+Support+Announcements+for+JIRA
https://confluence.atlassian.com/display/FISHEYE/End+of+Support+Announcements+for+FishEye
http://www.cls-solutions.com/blog/?p=626 Java CAPS EOL
https://code.google.com/p/jeeunit/ EOL
Struts2 2.3.20 (CVE-2014-7809)
https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.3.20
https://cwiki.apache.org/confluence/display/WW/S2-023
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2981 IBM Directory traversal vulnerability in the Web Console in IBM Data Studio 3.1.0 and 3.1.1
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2165 ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0
http://marxsoftware.blogspot.be/2011/11/apache-harmony-retiring-to-attic.html
http://www.auscert.org.au/render.html?it=21352 [HP-UX] Java7: Multiple vulnerabilities
http://seclists.org/fulldisclosure/2014/Dec/23 VMWare Java update 1.6 81
https://access.redhat.com/security/cve/CVE-2014-9087 Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.
https://lists.wisc.edu/read/messages?id=33836937
http://shiro-developer.582600.n2.nabble.com/Security-update-td7578464.html shiro CAS
https://issues.apache.org/jira/browse/SHIRO-518
http://www.cvedetails.com/cve/CVE-2014-7816/ undertow
(http://bugs.java.com/view_bug.do?bug_id=6366924)
http://bugs.java.com/view_bug.do;?bug_id=6202721 java5 urandom
GWT 2.5.1 XSS - http://www.gwtproject.org/release-notes.html#Release_Notes_2_7_0
http://seclists.org/fulldisclosure/2014/Dec/26 [SE-2014-02] Google App Engine Java security sandbox bypasses (project pending completion / action from Google)
https://news.ycombinator.com/item?id=8709610
http://seclists.org/fulldisclosure/2014/Dec/59
http://www.cvedetails.com/cve/CVE-2014-7868/ zoho
http://www.cvedetails.com/cve/CVE-2014-6034/ zoho
http://www.cvedetails.com/cve/CVE-2014-3627/ hadoop yarn kerberos
http://osdir.com/ml/user-struts.apache.org/2011-12/msg00084.html struts 2.0.4 EOL
http://www.reddit.com/r/netsec/comments/2pj5dn/predicting_struts_csrf_token_cve20147809/
http://blog.h3xstream.com/2014/12/predicting-struts-csrf-token-cve-2014.html
http://osvdb.org/show/osvdb/115997 Thermostat contains a flaw when the system is configured in a certain unspecified manner.
http://osvdb.org/show/osvdb/114603 F5 BIG-IP contains a flaw that allows traversing outside of a restricted path.
http://seclists.org/fulldisclosure/2014/Dec/71 java cms jease
http://osvdb.org/show/osvdb/116364 IBM WebSphere Service Registry and Repository (WSRR) contains an unspecified flaw related to access control checks during a retrieve to depth 0
http://osvdb.org/show/osvdb/116268 nexus
http://osvdb.org/show/osvdb/116427 maven
http://www.cvedetails.com/cve/CVE-2014-9527/ HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service
http://www.cvedetails.com/cve/CVE-2014-9494/ RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.
http://www.cvedetails.com/cve/CVE-2014-8152/ Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
http://www.cvedetails.com/cve/CVE-2014-0171/ XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint.
----------------------------------------------------------------------
http://osvdb.org/show/osvdb/116200 notepad++
http://osvdb.org/show/osvdb/116215 synology
http://osvdb.org/show/osvdb/116222 mcafee
http://osvdb.org/show/osvdb/116507 projectsend
http://www.cvedetails.com/cve/CVE-2015-2944/ sling
http://www.cvedetails.com/cve/CVE-2015-2994/
http://www.cvedetails.com/cve/CVE-2015-0779/
http://www.cvedetails.com/cve/CVE-2015-0263/ camel
http://www.cvedetails.com/cve/CVE-2015-0112/
http://www.cvedetails.com/cve/CVE-2010-5323/
http://www.cvedetails.com/cve/CVE-2014-0230/ tomcat
http://www.cvedetails.com/cve/CVE-2015-2282/ netweaver SAP
Apache POI 3.10.1 released CVE-2014-3529 CVE-2014-3574
https://mail-archives.apache.org/mod_mbox/www-announce/201506.mbox/%3C556ECB68.2080804%40apache.org%3E End of life for Apache Tomcat 6.0.
ttps://rhn.redhat.com/errata/RHSA-2013-0666.html
http://www.reddit.com/r/java/comments/39hzwa/why_is_executing_java_code_in_comments_allowed/
http://stackoverflow.com/questions/30727515/why-is-executing-java-code-in-comments-allowed