Protection mechanism failure in Apache Commons BeanUtils - CVE-2019-10086

Vulnerability identifier: #VU20844

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-10086

CWE-ID: CWE-693

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exist due to Beanutils is not using by default the a special BeanIntrospector class in PropertyUtilsBean that was supposed to suppress the ability for an attacker to access the classloader via the class property available on all Java objects. A remote attacker can abuse such application behavior against applications that were developed to rely on this security feature.

Apache Commons BeanUtils
Red Hat Software Collections
Oracle Agile PLM Framework
Jazz Foundation
Gentoo Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Anolis OS
Ubuntu
Opensuse
Fedora
ovirt-fast-forward-upgrade (Red Hat package)
apache-commons-beanutils (Red Hat package)
candlepin (Red Hat package)
ovirt-engine (Red Hat package)
satellite (Red Hat package)
libcommons-beanutils-java (Ubuntu package)
libcommons-beanutils-java-doc (Ubuntu package)
jsr-305
jsr-305-javadoc
isorelax
isorelax-javadoc
plexus-build-api
plexus-build-api-javadoc
jsch-javadoc
jsch
sisu-mojos
sisu-mojos-javadoc
sisu-javadoc
sisu-plexus
sisu-inject
cal10n-javadoc
cal10n
maven-cal10n-plugin
maven-artifact-transfer
maven-artifact-transfer-javadoc
plexus-languages-javadoc
plexus-languages
java_cup-manual
java_cup-javadoc
java_cup
atinject-javadoc
atinject-tck
atinject
plexus-i18n
plexus-i18n-javadoc
plexus-component-factories-pom
plexus-bsh-factory
plexus-bsh-factory-javadoc
plexus-ant-factory
plexus-ant-factory-javadoc
plexus-resources
plexus-resources-javadoc
plexus-component-api-javadoc
plexus-component-api
plexus-interactivity-api
plexus-interactivity-jline
plexus-interactivity
plexus-interactivity-javadoc
jtidy-javadoc
jtidy
ant-contrib
ant-contrib-javadoc
munge-maven-plugin
munge-maven-plugin-javadoc
aopalliance
aopalliance-javadoc
maven-artifact-resolver-javadoc
maven-artifact-resolver
geronimo-annotation-javadoc
geronimo-annotation
jboss-interceptors-1.2-api-javadoc
jboss-interceptors-1.2-api
ovirt-engine-extension-aaa-misc (Red Hat package)
glassfish-legal
maven-script-interpreter
maven-script-interpreter-javadoc
maven-shared-incremental-javadoc
maven-shared-incremental
maven-resolver
maven-resolver-api
maven-resolver-util
maven-resolver-transport-wagon
maven-resolver-transport-http
maven-resolver-connector-basic
maven-resolver-impl
maven-resolver-transport-file
maven-resolver-transport-classpath
maven-resolver-test-util
maven-resolver-spi
maven-resolver-javadoc
geronimo-jpa
geronimo-jpa-javadoc
geronimo-jms
geronimo-jms-javadoc
jzlib
jzlib-demo
jzlib-javadoc
jdom-demo
jdom-javadoc
jdom
jaxen-javadoc
jaxen-demo
jaxen
jdependency
jdependency-javadoc
plexus-velocity
plexus-velocity-javadoc
cdi-api
cdi-api-javadoc
spec-version-maven-plugin
spec-version-maven-plugin-javadoc
apache-commons-logging-javadoc
glassfish-annotation-api-javadoc
glassfish-annotation-api
apache-commons-logging
xml-commons-resolver-javadoc
xml-commons-resolver
felix-osgi-foundation-javadoc
felix-osgi-foundation
os-maven-plugin-javadoc
os-maven-plugin
log4j12-javadoc
log4j12
apache-commons-exec-javadoc
apache-commons-exec
hamcrest
hamcrest-core
hamcrest-demo
hamcrest-javadoc
apache-commons-jxpath
apache-commons-jxpath-javadoc
plexus-components-pom
apache-commons-cli-javadoc
apache-commons-cli
plexus-sec-dispatcher
plexus-sec-dispatcher-javadoc
felix-osgi-core-javadoc
felix-osgi-core
felix-osgi-compendium
felix-osgi-compendium-javadoc
maven-enforcer-plugin
maven-enforcer-rules
maven-enforcer-javadoc
maven-enforcer-api
maven-enforcer
xml-commons-apis
xml-commons-apis-javadoc
xml-commons-apis-manual
maven-remote-resources-plugin-javadoc
maven-remote-resources-plugin
objectweb-pom
regexp-javadoc
regexp
javamail-javadoc
javamail
plexus-cli
maven-verifier
plexus-cli-javadoc
maven-verifier-javadoc
xmlunit-javadoc
xmlunit
geronimo-parent-poms
exec-maven-plugin
exec-maven-plugin-javadoc
jflex-javadoc
jflex
powermock-javadoc
powermock-api-easymock
powermock-junit4
powermock-reflect
powermock-core
powermock-testng
powermock-common
powermock-api-support
powermock-api-mockito
jansi-native
jansi-native-javadoc
maven-doxia-module-xdoc
maven-doxia-module-apt
maven-doxia-logging-api
maven-doxia
maven-doxia-core
maven-doxia-javadoc
maven-doxia-module-confluence
maven-doxia-module-xhtml
maven-doxia-modules
maven-doxia-sink-api
maven-doxia-test-docs
maven-doxia-tests
maven-doxia-module-twiki
maven-doxia-module-rtf
maven-doxia-module-latex
maven-doxia-module-docbook-simple
maven-doxia-module-fml
plexus-cipher
plexus-cipher-javadoc
velocity
velocity-javadoc
velocity-demo
velocity-manual
plexus-containers-component-metadata
plexus-containers-component-annotations
plexus-containers
plexus-containers-component-javadoc
plexus-containers-container-default
plexus-containers-javadoc
maven-doxia-sitetools-javadoc
maven-doxia-sitetools
jul-to-slf4j
slf4j-ext
slf4j
slf4j-manual
log4j-over-slf4j
jcl-over-slf4j
slf4j-javadoc
slf4j-sources
slf4j-jcl
slf4j-jdk14
slf4j-log4j12
maven-dependency-analyzer
xz-java-javadoc
maven-dependency-analyzer-javadoc
xz-java
maven-antrun-plugin
maven-antrun-plugin-javadoc
modello-javadoc
modello
maven-plugin-build-helper
maven-plugin-build-helper-javadoc
apache-commons-beanutils
apache-commons-beanutils-javadoc
maven-invoker-plugin
maven-invoker-plugin-javadoc
felix-utils
felix-utils-javadoc
ant-jdepend
ant-junit
ant-jsch
ant-lib
ant-manual
ant-swing
ant-apache-log4j
ant-testutil
ant-xz
ant-apache-oro
ant-apache-regexp
ant-apache-resolver
ant-apache-xalan2
ant-commons-logging
ant-javamail
ant-apache-bsf
ant-javadoc
ant-jmf
ant-apache-bcel
ant-antlr
ant
ant-commons-net
mockito-javadoc
mockito
fusesource-pom
apache-commons-codec
apache-commons-codec-javadoc
jsoup-javadoc
jsoup
byaccj
maven-hawtjni-plugin
hawtjni-runtime
hawtjni-javadoc
hawtjni
jansi
jansi-javadoc
apache-commons-compress-javadoc
apache-commons-compress
plexus-interpolation
plexus-interpolation-javadoc
beust-jcommander
beust-jcommander-javadoc
apache-resource-bundles
qdox
qdox-javadoc
bsh
bsh-javadoc
bsh-manual
jdom2
jdom2-javadoc
jakarta-oro
jakarta-oro-javadoc
maven-invoker-javadoc
maven-invoker
maven-monitor
maven-model
maven-settings
maven-plugin-descriptor
maven-plugin-registry
maven-artifact
maven2-javadoc
maven-artifact-manager
maven-toolchain
maven-profile
maven-project
glassfish-jsp-api
glassfish-jsp-api-javadoc
apache-ivy-javadoc
apache-ivy
bsf-javadoc
bsf
maven-install-plugin-javadoc
maven-install-plugin
plexus-classworlds
plexus-classworlds-javadoc
objenesis-javadoc
objenesis
apache-commons-io-javadoc
apache-commons-io
apache-commons-lang-javadoc
apache-commons-lang
javacc-maven-plugin-javadoc
javacc-maven-plugin
xalan-j2-xsltc
xalan-j2-demo
xalan-j2
xalan-j2-manual
xalan-j2-javadoc
antlr-C++
antlr-manual
antlr-javadoc
antlr-tool
plexus-compiler-pom
plexus-compiler-javadoc
plexus-compiler-extras
plexus-compiler
jdepend-javadoc
jdepend-demo
jdepend
xerces-j2
xerces-j2-demo
xerces-j2-javadoc
jline
jline-javadoc
maven-surefire-provider-junit
maven-surefire-provider-testng
maven-surefire-report-parser
maven-surefire-report-plugin
maven-surefire
maven-failsafe-plugin
maven-surefire-javadoc
maven-surefire-plugin
maven-dependency-tree
maven-dependency-tree-javadoc
maven-reporting-api
maven-reporting-api-javadoc
plexus-io
plexus-io-javadoc
maven-reporting-impl
maven-reporting-impl-javadoc
maven-clean-plugin
maven-clean-plugin-javadoc
maven-shared-io
maven-shared-io-javadoc
maven-file-management
maven-file-management-javadoc
xmvn-minimal
xmvn-mojo
xmvn-javadoc
xmvn-resolve
xmvn-connector-ivy
xmvn-install
xmvn-connector-aether
xmvn-bisect
xmvn-api
xmvn-parent-pom
xmvn-core
xmvn
xmvn-tools-pom
xmvn-subst
glassfish-el-javadoc
glassfish-el
glassfish-el-api
maven-common-artifact-filters-javadoc
maven-source-plugin
maven-source-plugin-javadoc
maven-common-artifact-filters
maven-dependency-plugin-javadoc
maven-dependency-plugin
jakarta-commons-httpclient-manual
jakarta-commons-httpclient-javadoc
jakarta-commons-httpclient
jakarta-commons-httpclient-demo
maven-wagon-http
maven-wagon-provider-api
maven-wagon-ftp
maven-wagon-file
maven-wagon
maven-wagon-javadoc
maven-wagon-http-shared
maven-wagon-providers
maven-jar-plugin
maven-wagon-http-lightweight
maven-jar-plugin-javadoc
maven-assembly-plugin-javadoc
maven-shade-plugin-javadoc
maven-assembly-plugin
maven-resources-plugin
maven-resources-plugin-javadoc
plexus-utils
plexus-utils-javadoc
maven-shade-plugin
glassfish-servlet-api-javadoc
glassfish-servlet-api
maven-filtering
maven-filtering-javadoc
maven-archiver
maven-archiver-javadoc
maven-shared-utils-javadoc
maven-shared-utils
apache-commons-collections
apache-commons-collections-javadoc
apache-commons-collections-testframework
cglib-javadoc
cglib
maven-test-tools
maven-plugin-testing-tools
maven-plugin-testing-javadoc
maven-plugin-testing-harness
maven-plugin-testing
easymock
easymock-javadoc
maven-plugin-bundle-javadoc
maven-plugin-bundle
bnd-maven-plugin
aqute-bnd
aqute-bnd-javadoc
aqute-bndlib
maven-plugin-tools-beanshell
maven-script-ant
maven-script-beanshell
maven-plugin-annotations
maven-plugin-plugin
maven-plugin-tools
maven-plugin-tools-annotations
maven-plugin-tools-ant
maven-plugin-tools-api
maven-plugin-tools-generators
maven-plugin-tools-javadoc
maven-plugin-tools-javadocs
maven-plugin-tools-model
maven-script
maven-plugin-tools-java
maven
maven-lib
maven-javadoc
apache-commons-net
apache-commons-net-javadoc
plexus-archiver-javadoc
plexus-archiver
apache-commons-lang3-javadoc
apache-commons-lang3
maven-compiler-plugin
maven-compiler-plugin-javadoc
assertj-core-javadoc
assertj-core
javassist
javassist-javadoc
felix-parent
jvnet-parent
guice-jndi
guice-throwingproviders
guice-testlib
guice-servlet
guice-parent
guice-multibindings
guice-jmx
guice-grapher
guice-extensions
guice-bom
guice-assistedinject
google-guice-javadoc
google-guice
rhvm-dependencies (Red Hat package)
httpcomponents-core-javadoc
httpcomponents-core
httpcomponents-client-javadoc
httpcomponents-client-cache
httpcomponents-client
xbean
xbean-javadoc
junit-manual
junit-javadoc
junit
plexus-pom
ivy-local
javapackages-filesystem
maven-local
python3-javapackages
javapackages-local
javapackages-tools
osgi-compendium
osgi-compendium-javadoc
osgi-core-javadoc
osgi-core
osgi-annotation
osgi-annotation-javadoc
bcel
bcel-javadoc
objectweb-asm
objectweb-asm-javadoc
testng-javadoc
testng
sonatype-oss-parent
javacc
javacc-demo
javacc-javadoc
javacc-manual
glassfish-master-pom
sonatype-plugins-parent
httpcomponents-project
apache-parent
jboss-parent
guava20-testlib
guava20-javadoc
guava20
maven-shared
spice-parent
maven-parent
maven-plugins-pom
weld-parent
forge-parent
mojo-parent
apache-commons-parent
dev-java/commons-beanutils
commons-beanutils (Ubuntu package)
Library Support for Struts
Oracle Banking Platform
Oracle Utilities Framework
RecoverPoint Classic
Oracle Agile Engineering Data Management
Oracle Business Intelligence Enterprise Edition
Oracle Retail Xstore Point of Service
Oracle Financial Services Analytical Applications Infrastructure
Oracle Data Integrator
Oracle FLEXCUBE Private Banking
Oracle Application Testing Suite
Oracle Retail Back Office
Oracle Retail Central Office
Oracle Retail Returns Management
Oracle Retail Service Backbone
Oracle Retail Order Broker
Integration Designer
Multi-Enterprise Integration Gateway
B2B Advanced Communications
eDiscovery Manager
IBM Cloud Pak for Watson AIOps
IBM Sterling Order Management
Oracle Insurance Policy Administration Operational Data Store for Life and Annuity
Oracle Endeca Information Discovery Integrator
Oracle Hospitality OPERA 5
Oracle Fusion Middleware MapViewer
Oracle Retail Price Management
Oracle Insurance Data Gateway
Oracle Communications Convergence
Oracle Communications MetaSolv Solution
Oracle Communications Billing and Revenue Management
IBM PureData System for Operational Analytics
Oracle Health Sciences Data Management Workbench
Oracle Financial Services Revenue Management and Billing Analytics
Oracle Real-Time Decision Server
Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite
Agile Product Lifecycle Management Integration Pack for SAP: Design to Release
Oracle Product Lifecycle Analytics
IBM Tivoli Monitoring
Red Hat Satellite
Oracle Communications Design Studio
Oracle Communications Unified Inventory Management
Oracle Communications Network Integrity
Oracle Communications Diameter Signaling Router (DSR)
Oracle Financial Services Profitability Management
Oracle Financial Services Asset Liability Management
Oracle Insurance Allocation Manager for Enterprise Profitability
Oracle SD-WAN Edge
IBM Power Hardware Management Console (HMC)
Oracle Communications Performance Intelligence Center (PIC) Software
Oracle Communications EAGLE Element Management System
Netcool Operations Insight
IBM Cloud Pak for Business Automation
Oracle Blockchain Platform
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Policy
Planning Analytics Local
PeopleSoft Enterprise PT PeopleTools
Oracle Fusion Middleware
Operational Decision Manager
Real-Time Decisions (RTD) Solutions
Red Hat Virtualization
Oracle Service Bus
Red Hat Virtualization Manager
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
RSA Authentication Manager
Oracle Communications Evolved Communications Application Server
JBoss Enterprise Application Platform
Oracle WebLogic Server
Oracle Retail Predictive Application Server
Primavera Gateway
Fuse
Oracle Healthcare Foundation
Oracle Financial Services Funds Transfer Pricing
JD Edwards EnterpriseOne Tools
Oracle WebCenter Portal
Hyperion Planning
Oracle Communications Pricing Design Center
Oracle Human Resources
Oracle Retail Sales Audit
MySQL Enterprise Monitor
Oracle Communications BRM - Elastic Charging Engine
Oracle Financial Services Market Risk Measurement and Management
Oracle Hyperion Calculation Manager
Oracle Hospitality Reporting and Analytics
JD Edwards EnterpriseOne Orchestrator
Identity Manager
Oracle Commerce Guided Search
Oracle Time and Labor
Oracle Retail Advanced Inventory Planning
Oracle Retail Point of Service
Oracle Retail Financial Integration
Oracle Retail Allocation
Oracle Retail Merchandising System
Oracle Retail Invoice Matching
IBM Security Guardium
Oracle WebCenter Content
Enterprise Manager for Virtualization
Primavera Unifier
Oracle Retail Integration Bus
Red Hat Single Sign-On

Install updates from vendor's website.

Apache Commons BeanUtils - update to 1.9.4
ovirt-fast-forward-upgrade (Red Hat package) - update to 1.0.0-17.el7ev
apache-commons-beanutils (Red Hat package) - update to 1.8.3-15.el7_7
candlepin (Red Hat package) - update to 2.5.22-1.el7sat
ovirt-engine (Red Hat package) - update to 4.3.9.3-0.1.el7
satellite (Red Hat package) - update to 6.5.3.2-1.el7sat
Planning Analytics Local - update to 2.0.1
RecoverPoint Classic - update to 5.1 SP4 P4
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.8.0
JBoss Enterprise Application Platform - update to 7.2.7
JD Edwards EnterpriseOne Orchestrator - update to 9.2.5.3
JD Edwards EnterpriseOne Tools - update to 9.2.5.3
IBM Power Hardware Management Console (HMC) - addressed in versions 10.3.1064.0, 11.1.1112.0
libcommons-beanutils-java (Ubuntu package) - addressed in versions 1.9.1-1ubuntu0.1~esm1, 1.9.2-3ubuntu0.1~esm1, 1.9.3-1ubuntu0.1~esm1
libcommons-beanutils-java-doc (Ubuntu package) - update to 1.9.3-1ubuntu0.1~esm1
jsr-305 - update to 0-0.22.20130910svn
jsr-305-javadoc - update to 0-0.22.20130910svn
isorelax - update to 0-0.23.release20050331
isorelax-javadoc - update to 0-0.23.release20050331
plexus-build-api - update to 0.0.7-20
plexus-build-api-javadoc - update to 0.0.7-20
jsch-javadoc - update to 0.1.54-6
jsch - update to 0.1.54-6
sisu-mojos - update to 0.3.1-8
sisu-mojos-javadoc - update to 0.3.1-8
sisu-javadoc - update to 0.3.3-7
sisu-plexus - update to 0.3.3-7
sisu-inject - update to 0.3.3-7
cal10n-javadoc - update to 0.8.1-7
cal10n - update to 0.8.1-7
maven-cal10n-plugin - update to 0.8.1-7
maven-artifact-transfer - update to 0.9.0-4
maven-artifact-transfer-javadoc - update to 0.9.0-4
plexus-languages-javadoc - update to 0.9.10-3
plexus-languages - update to 0.9.10-3
java_cup-manual - update to 0.11b-8
java_cup-javadoc - update to 0.11b-8
java_cup - update to 0.11b-8
atinject-javadoc - update to 1-28.20100611svn86
atinject-tck - update to 1-28.20100611svn86
atinject - update to 1-28.20100611svn86
plexus-i18n - update to 1.0-0.11.b10.4
plexus-i18n-javadoc - update to 1.0-0.11.b10.4
plexus-component-factories-pom - update to 1.0-0.15.alpha11
plexus-bsh-factory - update to 1.0-0.19.a7
plexus-bsh-factory-javadoc - update to 1.0-0.19.a7
plexus-ant-factory - update to 1.0-0.20.a2.2
plexus-ant-factory-javadoc - update to 1.0-0.20.a2.2
plexus-resources - update to 1.0-0.23.a7
plexus-resources-javadoc - update to 1.0-0.23.a7
plexus-component-api-javadoc - update to 1.0-0.24.alpha15
plexus-component-api - update to 1.0-0.24.alpha15
plexus-interactivity-api - update to 1.0-0.27.alpha6
plexus-interactivity-jline - update to 1.0-0.27.alpha6
plexus-interactivity - update to 1.0-0.27.alpha6
plexus-interactivity-javadoc - update to 1.0-0.27.alpha6
jtidy-javadoc - update to 1.0-0.28.20100930svn1125
jtidy - update to 1.0-0.28.20100930svn1125
ant-contrib - update to 1.0-0.32.b3
ant-contrib-javadoc - update to 1.0-0.32.b3
munge-maven-plugin - update to 1.0-11
munge-maven-plugin-javadoc - update to 1.0-11
aopalliance - update to 1.0-17
aopalliance-javadoc - update to 1.0-17
maven-artifact-resolver-javadoc - update to 1.0-18
maven-artifact-resolver - update to 1.0-18
geronimo-annotation-javadoc - update to 1.0-23
geronimo-annotation - update to 1.0-23
jboss-interceptors-1.2-api-javadoc - update to 1.0.0-8
jboss-interceptors-1.2-api - update to 1.0.0-8
ovirt-engine-extension-aaa-misc (Red Hat package) - update to 1.0.4-1.el7ev
glassfish-legal - update to 1.1-11
maven-script-interpreter - update to 1.1-11
maven-script-interpreter-javadoc - update to 1.1-11
maven-shared-incremental-javadoc - update to 1.1-14
maven-shared-incremental - update to 1.1-14
maven-resolver - update to 1.1.1-2
maven-resolver-api - update to 1.1.1-2
maven-resolver-util - update to 1.1.1-2
maven-resolver-transport-wagon - update to 1.1.1-2
maven-resolver-transport-http - update to 1.1.1-2
maven-resolver-connector-basic - update to 1.1.1-2
maven-resolver-impl - update to 1.1.1-2
maven-resolver-transport-file - update to 1.1.1-2
maven-resolver-transport-classpath - update to 1.1.1-2
maven-resolver-test-util - update to 1.1.1-2
maven-resolver-spi - update to 1.1.1-2
maven-resolver-javadoc - update to 1.1.1-2
geronimo-jpa - update to 1.1.1-21
geronimo-jpa-javadoc - update to 1.1.1-21
geronimo-jms - update to 1.1.1-25
geronimo-jms-javadoc - update to 1.1.1-25
jzlib - update to 1.1.3-8
jzlib-demo - update to 1.1.3-8
jzlib-javadoc - update to 1.1.3-8
jdom-demo - update to 1.1.3-17
jdom-javadoc - update to 1.1.3-17
jdom - update to 1.1.3-17
jaxen-javadoc - update to 1.1.6-18
jaxen-demo - update to 1.1.6-18
jaxen - update to 1.1.6-18
jdependency - update to 1.2-2
jdependency-javadoc - update to 1.2-2
plexus-velocity - update to 1.2-4
plexus-velocity-javadoc - update to 1.2-4
cdi-api - update to 1.2-8
cdi-api-javadoc - update to 1.2-8
spec-version-maven-plugin - update to 1.2-11
spec-version-maven-plugin-javadoc - update to 1.2-11
apache-commons-logging-javadoc - update to 1.2-13
glassfish-annotation-api-javadoc - update to 1.2-13
glassfish-annotation-api - update to 1.2-13
apache-commons-logging - update to 1.2-13
xml-commons-resolver-javadoc - update to 1.2-26
xml-commons-resolver - update to 1.2-26
felix-osgi-foundation-javadoc - update to 1.2.0-23
felix-osgi-foundation - update to 1.2.0-23
os-maven-plugin-javadoc - update to 1.2.3-9
os-maven-plugin - update to 1.2.3-9
log4j12-javadoc - update to 1.2.17-22
log4j12 - update to 1.2.17-22
apache-commons-exec-javadoc - update to 1.3-8.0.1
apache-commons-exec - update to 1.3-8.0.1
hamcrest - update to 1.3-23
hamcrest-core - update to 1.3-23
hamcrest-demo - update to 1.3-23
hamcrest-javadoc - update to 1.3-23
apache-commons-jxpath - update to 1.3-29
apache-commons-jxpath-javadoc - update to 1.3-29
plexus-components-pom - update to 1.3.1-10
apache-commons-cli-javadoc - update to 1.4-4
apache-commons-cli - update to 1.4-4
plexus-sec-dispatcher - update to 1.4-26
plexus-sec-dispatcher-javadoc - update to 1.4-26
felix-osgi-core-javadoc - update to 1.4.0-23
felix-osgi-core - update to 1.4.0-23
felix-osgi-compendium - update to 1.4.0-26
felix-osgi-compendium-javadoc - update to 1.4.0-26
maven-enforcer-plugin - update to 1.4.1-8
maven-enforcer-rules - update to 1.4.1-8
maven-enforcer-javadoc - update to 1.4.1-8
maven-enforcer-api - update to 1.4.1-8
maven-enforcer - update to 1.4.1-8
xml-commons-apis - update to 1.4.01-25
xml-commons-apis-javadoc - update to 1.4.01-25
xml-commons-apis-manual - update to 1.4.01-25
maven-remote-resources-plugin-javadoc - update to 1.5-2
maven-remote-resources-plugin - update to 1.5-2
objectweb-pom - update to 1.5-7
regexp-javadoc - update to 1.5-26
regexp - update to 1.5-26
javamail-javadoc - update to 1.5.2-7
javamail - update to 1.5.2-7
plexus-cli - update to 1.6-6
maven-verifier - update to 1.6-6
plexus-cli-javadoc - update to 1.6-6
maven-verifier-javadoc - update to 1.6-6
xmlunit-javadoc - update to 1.6-7
xmlunit - update to 1.6-7
geronimo-parent-poms - update to 1.6-25
exec-maven-plugin - update to 1.6.0-3
exec-maven-plugin-javadoc - update to 1.6.0-3
jflex-javadoc - update to 1.6.1-12
jflex - update to 1.6.1-12
powermock-javadoc - update to 1.6.5-9
powermock-api-easymock - update to 1.6.5-9
powermock-junit4 - update to 1.6.5-9
powermock-reflect - update to 1.6.5-9
powermock-core - update to 1.6.5-9
powermock-testng - update to 1.6.5-9
powermock-common - update to 1.6.5-9
powermock-api-support - update to 1.6.5-9
powermock-api-mockito - update to 1.6.5-9
jansi-native - update to 1.7-7
jansi-native-javadoc - update to 1.7-7
maven-doxia-module-xdoc - update to 1.7-8
maven-doxia-module-apt - update to 1.7-8
maven-doxia-logging-api - update to 1.7-8
maven-doxia - update to 1.7-8
maven-doxia-core - update to 1.7-8
maven-doxia-javadoc - update to 1.7-8
maven-doxia-module-confluence - update to 1.7-8
maven-doxia-module-xhtml - update to 1.7-8
maven-doxia-modules - update to 1.7-8
maven-doxia-sink-api - update to 1.7-8
maven-doxia-test-docs - update to 1.7-8
maven-doxia-tests - update to 1.7-8
maven-doxia-module-twiki - update to 1.7-8
maven-doxia-module-rtf - update to 1.7-8
maven-doxia-module-latex - update to 1.7-8
maven-doxia-module-docbook-simple - update to 1.7-8
maven-doxia-module-fml - update to 1.7-8
plexus-cipher - update to 1.7-14
plexus-cipher-javadoc - update to 1.7-14
velocity - update to 1.7-24
velocity-javadoc - update to 1.7-24
velocity-demo - update to 1.7-24
velocity-manual - update to 1.7-24
plexus-containers-component-metadata - update to 1.7.1-8
plexus-containers-component-annotations - update to 1.7.1-8
plexus-containers - update to 1.7.1-8
plexus-containers-component-javadoc - update to 1.7.1-8
plexus-containers-container-default - update to 1.7.1-8
plexus-containers-javadoc - update to 1.7.1-8
maven-doxia-sitetools-javadoc - update to 1.7.5-2
maven-doxia-sitetools - update to 1.7.5-2
jul-to-slf4j - update to 1.7.25-4
slf4j-ext - update to 1.7.25-4
slf4j - update to 1.7.25-4
slf4j-manual - update to 1.7.25-4
log4j-over-slf4j - update to 1.7.25-4
jcl-over-slf4j - update to 1.7.25-4
slf4j-javadoc - update to 1.7.25-4
slf4j-sources - update to 1.7.25-4
slf4j-jcl - update to 1.7.25-4
slf4j-jdk14 - update to 1.7.25-4
slf4j-log4j12 - update to 1.7.25-4
maven-dependency-analyzer - update to 1.8-2
xz-java-javadoc - update to 1.8-2
maven-dependency-analyzer-javadoc - update to 1.8-2
xz-java - update to 1.8-2
maven-antrun-plugin - update to 1.8-6
maven-antrun-plugin-javadoc - update to 1.8-6
modello-javadoc - update to 1.9.1-7
modello - update to 1.9.1-7
maven-plugin-build-helper - update to 1.9.1-8
maven-plugin-build-helper-javadoc - update to 1.9.1-8
apache-commons-beanutils - update to 1.9.3-5
apache-commons-beanutils-javadoc - update to 1.9.3-5
apache-commons-beanutils - addressed in versions 1.9.4-1.fc30, 1.9.4-1.fc31
maven-invoker-plugin - update to 1.10-7
maven-invoker-plugin-javadoc - update to 1.10-7
felix-utils - update to 1.10.4-2
felix-utils-javadoc - update to 1.10.4-2
ant-jdepend - update to 1.10.5-1
ant-junit - update to 1.10.5-1
ant-jsch - update to 1.10.5-1
ant-lib - update to 1.10.5-1
ant-manual - update to 1.10.5-1
ant-swing - update to 1.10.5-1
ant-apache-log4j - update to 1.10.5-1
ant-testutil - update to 1.10.5-1
ant-xz - update to 1.10.5-1
ant-apache-oro - update to 1.10.5-1
ant-apache-regexp - update to 1.10.5-1
ant-apache-resolver - update to 1.10.5-1
ant-apache-xalan2 - update to 1.10.5-1
ant-commons-logging - update to 1.10.5-1
ant-javamail - update to 1.10.5-1
ant-apache-bsf - update to 1.10.5-1
ant-javadoc - update to 1.10.5-1
ant-jmf - update to 1.10.5-1
ant-apache-bcel - update to 1.10.5-1
ant-antlr - update to 1.10.5-1
ant - update to 1.10.5-1
ant-commons-net - update to 1.10.5-1
mockito-javadoc - update to 1.10.19-17
mockito - update to 1.10.19-17
fusesource-pom - update to 1.11-3
apache-commons-codec - update to 1.11-3
apache-commons-codec-javadoc - update to 1.11-3
jsoup-javadoc - update to 1.11.3-3
jsoup - update to 1.11.3-3
byaccj - update to 1.15-17
maven-hawtjni-plugin - update to 1.16-2
hawtjni-runtime - update to 1.16-2
hawtjni-javadoc - update to 1.16-2
hawtjni - update to 1.16-2
jansi - update to 1.17.1-1
jansi-javadoc - update to 1.17.1-1
apache-commons-compress-javadoc - update to 1.18-1
apache-commons-compress - update to 1.18-1
plexus-interpolation - update to 1.22-9
plexus-interpolation-javadoc - update to 1.22-9
beust-jcommander - update to 1.71-5
beust-jcommander-javadoc - update to 1.71-5
apache-resource-bundles - update to 2-20
qdox - update to 2.0-3.M9
qdox-javadoc - update to 2.0-3.M9
bsh - update to 2.0-13.b6
bsh-javadoc - update to 2.0-13.b6
bsh-manual - update to 2.0-13.b6
jdom2 - update to 2.0.6-12
jdom2-javadoc - update to 2.0.6-12
jakarta-oro - update to 2.0.8-23
jakarta-oro-javadoc - update to 2.0.8-23
maven-invoker-javadoc - update to 2.2-7
maven-invoker - update to 2.2-7
maven-monitor - update to 2.2.1-59
maven-model - update to 2.2.1-59
maven-settings - update to 2.2.1-59
maven-plugin-descriptor - update to 2.2.1-59
maven-plugin-registry - update to 2.2.1-59
maven-artifact - update to 2.2.1-59
maven2-javadoc - update to 2.2.1-59
maven-artifact-manager - update to 2.2.1-59
maven-toolchain - update to 2.2.1-59
maven-profile - update to 2.2.1-59
maven-project - update to 2.2.1-59
glassfish-jsp-api - update to 2.3.2-0.9.b01
glassfish-jsp-api-javadoc - update to 2.3.2-0.9.b01
apache-ivy-javadoc - update to 2.4.0-14
apache-ivy - update to 2.4.0-14
bsf-javadoc - update to 2.4.0-30
bsf - update to 2.4.0-30
maven-install-plugin-javadoc - update to 2.5.2-7
maven-install-plugin - update to 2.5.2-7
plexus-classworlds - update to 2.5.2-9
plexus-classworlds-javadoc - update to 2.5.2-9
objenesis-javadoc - update to 2.6-2
objenesis - update to 2.6-2
apache-commons-io-javadoc - update to 2.6-3
apache-commons-io - update to 2.6-3
apache-commons-lang-javadoc - update to 2.6-21
apache-commons-lang - update to 2.6-21
javacc-maven-plugin-javadoc - update to 2.6-25
javacc-maven-plugin - update to 2.6-25
xalan-j2-xsltc - update to 2.7.1-38
xalan-j2-demo - update to 2.7.1-38
xalan-j2 - update to 2.7.1-38
xalan-j2-manual - update to 2.7.1-38
xalan-j2-javadoc - update to 2.7.1-38
antlr-C++ - update to 2.7.7-56
antlr-manual - update to 2.7.7-56
antlr-javadoc - update to 2.7.7-56
antlr-tool - update to 2.7.7-56
plexus-compiler-pom - update to 2.8.2-2
plexus-compiler-javadoc - update to 2.8.2-2
plexus-compiler-extras - update to 2.8.2-2
plexus-compiler - update to 2.8.2-2
jdepend-javadoc - update to 2.9.1-18
jdepend-demo - update to 2.9.1-18
jdepend - update to 2.9.1-18
xerces-j2 - update to 2.11.0-34
xerces-j2-demo - update to 2.11.0-34
xerces-j2-javadoc - update to 2.11.0-34
jline - update to 2.14.6-2
jline-javadoc - update to 2.14.6-2
maven-surefire-provider-junit - update to 2.22.0-3
maven-surefire-provider-testng - update to 2.22.0-3
maven-surefire-report-parser - update to 2.22.0-3
maven-surefire-report-plugin - update to 2.22.0-3
maven-surefire - update to 2.22.0-3
maven-failsafe-plugin - update to 2.22.0-3
maven-surefire-javadoc - update to 2.22.0-3
maven-surefire-plugin - update to 2.22.0-3
maven-dependency-tree - update to 3.0-5
maven-dependency-tree-javadoc - update to 3.0-5
maven-reporting-api - update to 3.0-14
maven-reporting-api-javadoc - update to 3.0-14
plexus-io - update to 3.0.0-2
plexus-io-javadoc - update to 3.0.0-2
maven-reporting-impl - update to 3.0.0-4
maven-reporting-impl-javadoc - update to 3.0.0-4
maven-clean-plugin - update to 3.0.0-5
maven-clean-plugin-javadoc - update to 3.0.0-5
maven-shared-io - update to 3.0.0-5
maven-shared-io-javadoc - update to 3.0.0-5
maven-file-management - update to 3.0.0-5
maven-file-management-javadoc - update to 3.0.0-5
xmvn-minimal - update to 3.0.0-21
xmvn-mojo - update to 3.0.0-21
xmvn-javadoc - update to 3.0.0-21
xmvn-resolve - update to 3.0.0-21
xmvn-connector-ivy - update to 3.0.0-21
xmvn-install - update to 3.0.0-21
xmvn-connector-aether - update to 3.0.0-21
xmvn-bisect - update to 3.0.0-21
xmvn-api - update to 3.0.0-21
xmvn-parent-pom - update to 3.0.0-21
xmvn-core - update to 3.0.0-21
xmvn - update to 3.0.0-21
xmvn-tools-pom - update to 3.0.0-21
xmvn-subst - update to 3.0.0-21
glassfish-el-javadoc - update to 3.0.1-0.7.b08
glassfish-el - update to 3.0.1-0.7.b08
glassfish-el-api - update to 3.0.1-0.7.b08
maven-common-artifact-filters-javadoc - update to 3.0.1-4
maven-source-plugin - update to 3.0.1-4
maven-source-plugin-javadoc - update to 3.0.1-4
maven-common-artifact-filters - update to 3.0.1-4
maven-dependency-plugin-javadoc - update to 3.0.2-2
maven-dependency-plugin - update to 3.0.2-2
jakarta-commons-httpclient-manual - update to 3.1-28
jakarta-commons-httpclient-javadoc - update to 3.1-28
jakarta-commons-httpclient - update to 3.1-28
jakarta-commons-httpclient-demo - update to 3.1-28
maven-wagon-http - update to 3.1.0-1
maven-wagon-provider-api - update to 3.1.0-1
maven-wagon-ftp - update to 3.1.0-1
maven-wagon-file - update to 3.1.0-1
maven-wagon - update to 3.1.0-1
maven-wagon-javadoc - update to 3.1.0-1
maven-wagon-http-shared - update to 3.1.0-1
maven-wagon-providers - update to 3.1.0-1
maven-jar-plugin - update to 3.1.0-1
maven-wagon-http-lightweight - update to 3.1.0-1
maven-jar-plugin-javadoc - update to 3.1.0-1
maven-assembly-plugin-javadoc - update to 3.1.0-3
maven-shade-plugin-javadoc - update to 3.1.0-3
maven-assembly-plugin - update to 3.1.0-3
maven-resources-plugin - update to 3.1.0-3
maven-resources-plugin-javadoc - update to 3.1.0-3
plexus-utils - update to 3.1.0-3
plexus-utils-javadoc - update to 3.1.0-3
maven-shade-plugin - update to 3.1.0-3
glassfish-servlet-api-javadoc - update to 3.1.0-14
glassfish-servlet-api - update to 3.1.0-14
maven-filtering - update to 3.1.1-5
maven-filtering-javadoc - update to 3.1.1-5
maven-archiver - update to 3.2.0-2
maven-archiver-javadoc - update to 3.2.0-2
maven-shared-utils-javadoc - update to 3.2.1-0.1
maven-shared-utils - update to 3.2.1-0.1
apache-commons-collections - update to 3.2.2-10
apache-commons-collections-javadoc - update to 3.2.2-10
apache-commons-collections-testframework - update to 3.2.2-10
cglib-javadoc - update to 3.2.4-7
cglib - update to 3.2.4-7
maven-test-tools - update to 3.3.0-12
maven-plugin-testing-tools - update to 3.3.0-12
maven-plugin-testing-javadoc - update to 3.3.0-12
maven-plugin-testing-harness - update to 3.3.0-12
maven-plugin-testing - update to 3.3.0-12
easymock - update to 3.5-4
easymock-javadoc - update to 3.5-4
maven-plugin-bundle-javadoc - update to 3.5.0-2
maven-plugin-bundle - update to 3.5.0-2
bnd-maven-plugin - update to 3.5.0-4
aqute-bnd - update to 3.5.0-4
aqute-bnd-javadoc - update to 3.5.0-4
aqute-bndlib - update to 3.5.0-4
maven-plugin-tools-beanshell - update to 3.5.1-4
maven-script-ant - update to 3.5.1-4
maven-script-beanshell - update to 3.5.1-4
maven-plugin-annotations - update to 3.5.1-4
maven-plugin-plugin - update to 3.5.1-4
maven-plugin-tools - update to 3.5.1-4
maven-plugin-tools-annotations - update to 3.5.1-4
maven-plugin-tools-ant - update to 3.5.1-4
maven-plugin-tools-api - update to 3.5.1-4
maven-plugin-tools-generators - update to 3.5.1-4
maven-plugin-tools-javadoc - update to 3.5.1-4
maven-plugin-tools-javadocs - update to 3.5.1-4
maven-plugin-tools-model - update to 3.5.1-4
maven-script - update to 3.5.1-4
maven-plugin-tools-java - update to 3.5.1-4
maven - update to 3.5.4-5
maven-lib - update to 3.5.4-5
maven-javadoc - update to 3.5.4-5
apache-commons-net - update to 3.6-3
apache-commons-net-javadoc - update to 3.6-3
plexus-archiver-javadoc - update to 3.6.0-1
plexus-archiver - update to 3.6.0-1
apache-commons-lang3-javadoc - update to 3.7-3
apache-commons-lang3 - update to 3.7-3
maven-compiler-plugin - update to 3.7.0-2
maven-compiler-plugin-javadoc - update to 3.7.0-2
assertj-core-javadoc - update to 3.8.0-2
assertj-core - update to 3.8.0-2
javassist - update to 3.18.1-8
javassist-javadoc - update to 3.18.1-8
felix-parent - update to 4-5
jvnet-parent - update to 4-10
guice-jndi - update to 4.1-11
guice-throwingproviders - update to 4.1-11
guice-testlib - update to 4.1-11
guice-servlet - update to 4.1-11
guice-parent - update to 4.1-11
guice-multibindings - update to 4.1-11
guice-jmx - update to 4.1-11
guice-grapher - update to 4.1-11
guice-extensions - update to 4.1-11
guice-bom - update to 4.1-11
guice-assistedinject - update to 4.1-11
google-guice-javadoc - update to 4.1-11
google-guice - update to 4.1-11
rhvm-dependencies (Red Hat package) - update to 4.3.2-1.el7ev
httpcomponents-core-javadoc - update to 4.4.10-4
httpcomponents-core - update to 4.4.10-4
httpcomponents-client-javadoc - update to 4.5.5-4
httpcomponents-client-cache - update to 4.5.5-4
httpcomponents-client - update to 4.5.5-4
xbean - update to 4.8-1
xbean-javadoc - update to 4.8-1
junit-manual - update to 4.12-9
junit-javadoc - update to 4.12-9
junit - update to 4.12-9
plexus-pom - update to 5.0-2
ivy-local - update to 5.3.0-2
javapackages-filesystem - update to 5.3.0-2
maven-local - update to 5.3.0-2
python3-javapackages - update to 5.3.0-2
javapackages-local - update to 5.3.0-2
javapackages-tools - update to 5.3.0-2
osgi-compendium - update to 6.0.0-5
osgi-compendium-javadoc - update to 6.0.0-5
osgi-core-javadoc - update to 6.0.0-6
osgi-core - update to 6.0.0-6
osgi-annotation - update to 6.0.0-7
osgi-annotation-javadoc - update to 6.0.0-7
bcel - update to 6.2-2
bcel-javadoc - update to 6.2-2
objectweb-asm - update to 6.2-5
objectweb-asm-javadoc - update to 6.2-5
testng-javadoc - update to 6.14.3-5
testng - update to 6.14.3-5
sonatype-oss-parent - update to 7-14
javacc - update to 7.0.2-6
javacc-demo - update to 7.0.2-6
javacc-javadoc - update to 7.0.2-6
javacc-manual - update to 7.0.2-6
glassfish-master-pom - update to 8-11
sonatype-plugins-parent - update to 8-12
httpcomponents-project - update to 9-2
apache-parent - update to 19-2
jboss-parent - update to 20-4
guava20-testlib - update to 20.0-8
guava20-javadoc - update to 20.0-8
guava20 - update to 20.0-8
maven-shared - update to 22-6
spice-parent - update to 26-8
maven-parent - update to 27-5
maven-plugins-pom - update to 28-7
weld-parent - update to 34-5
forge-parent - update to 38-11
mojo-parent - update to 40-6
apache-commons-parent - update to 43-2
Multi-Enterprise Integration Gateway - update to 1.0.0.8
B2B Advanced Communications - update to 1.0.0.8
Netcool Operations Insight - update to 1.6.6
eDiscovery Manager - update to 2.2.2.3.7
IBM Cloud Pak for Watson AIOps - update to 3.6.2
Fuse - addressed in versions 6.3.0, 7.6.0
Jazz Foundation - update to 7.0.2.0.29
Red Hat Single Sign-On - update to 7.3.7
RSA Authentication Manager - update to 8.4 Patch 9
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 33, 8.11.0.1 Interim fix 15, 8.11.1 Interim fix 4
IBM Sterling Order Management - addressed in versions 9.4.0 SFP6, 9.5.0 SFP5, 10.0 SFP2
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF034, 23.0.2-IF006
Oracle Blockchain Platform - update to 21.1.2
dev-java/commons-beanutils - update to 1.9.4
commons-beanutils (Ubuntu package) - update to 1.9.2-3ubuntu0.1~esm2

• http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4@apache.org%3e
• https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125@%3Ccommits.tinkerpop.apache.org%3E

• Security restrictions bypass in Apache Commons BeanUtils
• OpenSUSE Linux update for apache-commons-beanutils
• Red Hat update for rh-maven35-apache-commons-beanutils
• Red Hat Software Collections update for rh-java-common-apache-commons-beanutils
• Red Hat update for apache-commons-beanutils
• Multiple vulnerabilities in JBoss Enterprise Application Platform
• Red Hat update for Red Hat Virtualization Engine
• Multiple vulnerabilities in Primavera Gateway
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Red Hat Satellite 6 update for candlepin and satellite
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in Oracle Communications MetaSolv Solution
• Protection mechanism failure in Oracle SD-WAN Edge
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router (DSR)
• Multiple vulnerabilities in Primavera Unifier
• Protection mechanism failure in Oracle Fusion Middleware MapViewer
• Multiple vulnerabilities in Oracle Endeca Information Discovery Integrator
• Multiple vulnerabilities in Oracle Real-Time Decision Server
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Oracle Data Integrator
• Multiple vulnerabilities in MySQL Enterprise Monitor
• Multiple vulnerabilities in Oracle Retail Service Backbone
• Multiple vulnerabilities in Oracle Retail Integration Bus
• Multiple vulnerabilities in Oracle Retail Financial Integration
• Multiple vulnerabilities in Oracle Retail Order Broker
• Protection mechanism failure in Oracle Insurance Allocation Manager for Enterprise Profitability
• Protection mechanism failure in Oracle Financial Services Profitability Management
• Protection mechanism failure in Oracle Financial Services Funds Transfer Pricing
• Protection mechanism failure in Oracle Financial Services Asset Liability Management
• Multiple vulnerabilities in Oracle Financial Services Market Risk Measurement and Management
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Multiple vulnerabilities in Oracle Utilities Framework
• Multiple vulnerabilities in Oracle Communications Performance Intelligence Center Software
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Protection mechanism failure in Enterprise Manager for Virtualization
• Multiple vulnerabilities in Oracle Banking Platform
• Multiple vulnerabilities in Oracle FLEXCUBE Private Banking
• Protection mechanism failure in Oracle Service Bus
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle Fusion Middleware
• Protection mechanism failure in Oracle Insurance Data Gateway
• Multiple vulnerabilities in Oracle Hospitality OPERA 5
• Protection mechanism failure in Oracle Healthcare Foundation
• Multiple vulnerabilities in PeopleSoft Enterprise PT PeopleTools
• Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
• Security restrictions bypass in Oracle JD Edwards EnterpriseOne Orchestrator
• Multiple vulnerabilities in Oracle Retail Returns Management
• Multiple vulnerabilities in Oracle Retail Point-of-Service
• Multiple vulnerabilities in Oracle Retail Central Office
• Multiple vulnerabilities in Oracle Retail Back Office
• Multiple vulnerabilities in Oracle Retail Advanced Inventory Planning
• Multiple vulnerabilities in Oracle Retail Predictive Application Server
• Protection mechanism failure in Oracle Agile PLM Framework
• Protection mechanism failure in Agile Product Lifecycle Management Integration Pack for SAP: Design to Release
• Protection mechanism failure in Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite
• Multiple vulnerabilities in Oracle Communications Pricing Design Center
• Protection mechanism failure in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle Communications Evolved Communications Application Server
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Protection mechanism failure in Oracle Application Testing Suite
• Multiple vulnerabilities in Oracle Financial Services Revenue Management and Billing Analytics
• Protection mechanism failure in Real-Time Decisions (RTD) Solutions
• Protection mechanism failure in Oracle Retail Price Management
• Multiple vulnerabilities in Oracle Retail Merchandising System
• Multiple vulnerabilities in Oracle Communications Convergence
• Multiple vulnerabilities in Oracle Communications Design Studio
• Multiple vulnerabilities in Oracle Time and Labor
• Protection mechanism failure in Oracle Hospitality Reporting and Analytics
• Multiple vulnerabilities in Oracle Blockchain Platform
• Multiple vulnerabilities in Oracle Communications Network Integrity
• Multiple vulnerabilities in Oracle Retail Invoice Matching
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in Oracle Health Sciences Data Management Workbench
• Protection mechanism failure in Oracle Retail Allocation
• Multiple vulnerabilities in Oracle Retail Sales Audit
• Multiple vulnerabilities in Oracle Product Lifecycle Analytics
• Multiple vulnerabilities in Oracle Agile Engineering Data Management
• Multiple vulnerabilities in IBM PureData System for Operational Analytics
• Protection mechanism failure in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in IBM Planning Analytics Local
• Protection mechanism failure in Oracle Human Resources
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM B2B Advanced Communications
• Multiple vulnerabilities in IBM eDiscovery Manager
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle Insurance Policy Administration Operational Data Store for Life and Annuity
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Multiple vulnerabilities in Dell RecoverPoint Classic
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle WebCenter Content
• Multiple vulnerabilities in Identity Manager
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in Oracle Hyperion Calculation Manager
• Multiple vulnerabilities in Hyperion Planning
• Multiple vulnerabilities in IBM Integration Designer
• Protection mechanism failure in IBM Sterling Order Management
• Multiple vulnerabilities in IBM Jazz Foundation
• Gentoo update for Commons-BeanUtils
• Multiple vulnerabilities in Oracle Communications EAGLE Element Management System
• Multiple vulnerabilities in Red Hat Single Sign-On 7.3
• Protection mechanism failure in Fuse 7.6
• Multiple vulnerabilities in Fuse 6
• Fedora 31 update for apache-commons-beanutils
• Fedora 30 update for apache-commons-beanutils
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Anolis OS update for javapackages-tools:201801 module
• IBM Power Hardware Management Console (HMC) update for Apache Commons Beanutils
• Ubuntu update for commons-beanutils
• Multiple vulnerabilities in IBM Library Support for Struts
• Ubuntu update for commons-beanutils