漏洞公告

XML external entity injection in Terracotta Quartz Scheduler

Directory traversal in Apache RocketMQ

Privilege escalation in mysql-connector-jav

Denial of service in XStream

XML External Entity Injection in XStream

Denial of service in Netty

Information Exposure in Netty

Deserialization of Untrusted Data in jackson-databind

Privilege escalation in Presto

Authorization bypass in express-jwt

ECDSA signature vulnerability of Minerva timing attack in jsrsasign

ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign

JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0

RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign

RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign

Log Forging in generator-jhipster-kotlin

Untrusted users can run pending migrations in production in Rails

Directory traversal outside of SENDFILE_ROOT in django-sendfile2

Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

Timing attack on django-basic-auth-ip-whitelist

Command Injection in Limdu

Regular expression denial of service in url-regex

Command injection in mversion