Archive
24 May 2018
Vulnerabilities first published on this day (UTC), newest first.
2 results · Clear filters · Feed
-
Critical 9.8CVE-2018-8013 EPSS 19%
Deserialization of Untrusted Data in Apache Batik
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling n…
-
Critical 9.1
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of s…