Threats tagged 'maven'

CVE-2024-25710 is a denial of service vulnerability in Apache Commons Compress affecting versions from 1.3 up to 1.25.0. The flaw is caused by an infinite loop triggered by processing a corrupted DUMP file. This issue is fixed in version 1.26.0. The vulnerability has a medium severity with a CVSS score of 5.9.

CVE-2024-20925 is a low-severity vulnerability in the JavaFX component of Oracle Java SE and Oracle GraalVM Enterprise Edition. It affects certain versions of these products, allowing an unauthenticated attacker with network access and requiring user interaction to potentially perform unauthorized update, insert, or delete operations on accessible data. This vulnerability primarily impacts Java deployments running sandboxed Java Web Start applications or applets that load untrusted code. It does not affect server-side deployments running only trusted code. The vulnerability has a CVSS 3.1 base score of 3.1, indicating low impact on integrity without confidentiality or availability impact. Oracle has released patches to address this issue.

Angular versions from 1.3.0 up to 1.8.3 contain a vulnerability in the ng-srcset directive where a regular expression used to split its value can cause super-linear runtime due to catastrophic backtracking. This can lead to denial of service when processing large, specially crafted inputs. The affected Angular package is end-of-life and will not receive updates; users are advised to migrate to @angular/core.

A StackOverflow vulnerability (CVE-2024-21634) exists in the ion-java library versions prior to 1.10.5. This flaw can cause a denial-of-service condition when deserializing crafted Ion text or binary data or when invoking certain IonValue methods on the deserialized data. The issue is fixed in ion-java version 1.10.5.