2024-30 Java Security Weekly News - Canonical, GitHub
2024 » Published on August 9, 2024
 | Ubuntu Security Notices |
 | Github Security Advisories |
 | Java CVEs |
| N/A | CVE-2024-7314 anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Published Friday, August 2, 2024 |
| N/A | CVE-2024-41995 Initialization of a resource with an insecure default vulnerability exists in JavaTM Platform Ver.12.89 and earlier. If this vulnerability is exploited, the product may be affected by some known TLS1.0 and TLS1.1 vulnerabilities. As for the specific products/models/versions of MFPs and printers that contain JavaTM Platform, see the information provided by the vendor. Published Tuesday, August 6, 2024 |
| 8.8 | CVE-2024-7552 A vulnerability was found in DataGear up to 5.0.0. It has been declared as critical. Affected by this vulnerability is the function evaluateVariableExpression of the file ConversionSqlParamValueMapper.java of the component Data Schema Page. The manipulation leads to improper neutralization of special elements used in an expression language statement. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273697 was assigned to this vulnerability. Published Tuesday, August 6, 2024 |