Philippe Arteau

**Name of the Vulnerable Software and Affected Versions** Java SE versions 7u261, 8u251, 11.0.7, and 14.0.1 Java SE Embedded version 8u251 **Description** The issue is related to insufficient input validation in the JSSE component of Oracle Java SE and Java SE Embedded. This can allow a remote attacker to gain unauthorized access to protected information. The vulnerability is difficult to exploit and can be used by an unauthenticated attacker with network access via TLS to compromise Java SE and Java SE Embedded, resulting in unauthorized read access to a subset of accessible data. It can be exploited through sandboxed Java Web Start applications, sandboxed Java applets, or by supplying data to APIs in the specified component. **Recommendations** For Java SE versions 7u261, 8u251, 11.0.7, and 14.0.1, update to a version that contains the fix for this issue. For Java SE Embedded version 8u251, update to a version that contains the fix for this issue. As a temporary workaround, consider restricting access to the JSSE component until a patch is available. Avoid using the JSSE component for sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** esigate version 5.2 and earlier **Description** The issue concerns a problem with the neutralization of special elements in output used by a downstream component, which can lead to remote code execution. This is exploitable via the use of another weakness in the backend application to reflect ESI directives. **Recommendations** For esigate versions 5.2 and earlier, update to version 5.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Spring Security OAuth versions 2.0 prior to 2.0.15 Spring Security OAuth versions 2.1 prior to 2.1.2 Spring Security OAuth versions 2.2 prior to 2.2.2 Spring Security OAuth versions 2.3 prior to 2.3.3 **Description** The issue allows a malicious user to craft an authorization request to the "authorization endpoint" that can lead to remote code execution when the resource owner is forwarded to the "approval endpoint". This can be exploited by an attacker. **Recommendations** For versions 2.0 prior to 2.0.15, update to version 2.0.15 or later. For versions 2.1 prior to 2.1.2, update to version 2.1.2 or later. For versions 2.2 prior to 2.2.2, update to version 2.2.2 or later. For versions 2.3 prior to 2.3.3, update to version 2.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** Pivotal Spring Framework versions 4.1.x through 4.1.4 **Description** The Java SockJS client in the affected software generates predictable session ids. This allows remote attackers to send messages to other sessions, potentially leading to unauthorized access or data manipulation. **Recommendations** For versions 4.1.x through 4.1.4, update to version 4.1.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Atlassian JIRA versions prior to 6.0.5 **Description** A directory traversal issue in the Importers plugin allows remote attackers to create arbitrary files. **Recommendations** For versions prior to 6.0.5, update to version 6.0.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Atlassian JIRA versions prior to 6.0.4 **Description** A directory traversal issue exists, allowing remote attackers to create arbitrary files. **Recommendations** For versions prior to 6.0.4, update to version 6.0.4 or later to resolve the issue.