Oracle Communications Cloud Native Core Binding Support Function 22.1.3

net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.

Published: 2022-02-22T01:41:05.000Z
Updated: 2024-08-03T04:42:50.324Z

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.

Published: 2022-02-25T14:35:03.000Z
Updated: 2024-08-03T04:07:02.514Z

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

Published: 2022-01-14T00:00:00.000Z
Updated: 2025-05-05T16:27:25.152Z

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Published: 2022-04-01T22:17:30.000Z
Updated: 2025-10-21T23:15:42.792Z

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Published: 2022-03-03T00:00:00.000Z
Updated: 2025-10-21T23:15:45.220Z