Search Vulnerabilities

OmniFaces: Forged combined-resource IDs and related output/push boundaries

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

Eclipse Jetty: Path parameter traversal

Eclipse Jetty: HTTP Authority/Host mismatch

Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder