Skip to content
OpenAdvisories

Archive

24 May 2018

Vulnerabilities first published on this day (UTC), newest first.

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2018-8013 EPSS 19%

    Deserialization of Untrusted Data in Apache Batik

    In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling n…

  • Critical 9.1

    curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of s…