CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration…

Vulnerability in the Oracle Business Process Management Suite component of Oracle Fusion Middleware (subcomponent: BPM Foundation Services)

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop

Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in…