Code Injection in Apache Velocity Engine - CVE-2020-13936

Vulnerability identifier: #VU51511

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-13936

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote attacker with ability to modify Velocity templates can inject and execute arbitrary Java code on the system with the same privileges as the account running the Servlet container.

Apache Velocity Engine
IBM App Connect Enterprise
Oracle GoldenGate Studio
Jazz Foundation
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
Gentoo Linux
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Module for Development Tools
Development Tools Module
openSUSE Leap
Ubuntu
openEuler
Fedora
Oracle Communications Cloud Native Core Policy
IBM Cloud Pak System
Oracle Banking Enterprise Default Management
Oracle Banking Party Management
Oracle Banking Deposits and Lines of Credit Servicing
Oracle Banking Loans Servicing
IBM Intelligent Operations Center
Oracle Communications Network Integrity
IBM Integration Bus
Oracle Identity Management Suite
Middleware Common Libraries and Tools
Oracle Middleware Common Libraries and Tools
Oracle Hospitality Token Proxy Service
Oracle Banking APIs
QRadar User Behavior Analytics
IBM Match 360
IBM Sterling External Authentication Server
IBM UrbanCode Release
Oracle Banking Platform
Oracle Communications User Data Repository
Oracle Retail Order Broker
Oracle Retail Service Backbone
Oracle Banking Digital Experience
IBM Planning Analytics Workspace
Cloud Pak for Network Automation
UrbanCode Build
Engineering Lifecycle Management - Jazz Foundation
Engineering Test Management
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect for Virtual Environments: Data Protection for VMware
Oracle Utilities Application Framework
Oracle Utilities Testing Accelerator
Oracle Retail Xstore Office Cloud Service
JBoss Enterprise Application Platform
Oracle WebLogic Server
Juniper Secure Analytics (JSA)
Oracle Retail Integration Bus
velocity (Ubuntu package)
plexus-build-api
sisu
sisu-mojos
java_cup
maven-artifact-transfer
atinject
plexus-languages
munge-maven-plugin
plexus-resources
apiguardian
jdom
maven-shared-incremental
opentest4j
apache-commons-logging
jakarta-annotations
eap7-jettison (Red Hat package)
apache-commons-jxpath
apache-commons-cli
plexus-sec-dispatcher
maven-resolver
eap7-velocity (Red Hat package)
maven-remote-resources-plugin
jflex
velocity
plexus-cipher
velocity-help
slf4j
xz-java
apache-commons-beanutils
byte-buddy
maven-dependency-analyzer
modello
felix-utils
fusesource-pom
jsoup
maven-dependency-analyzer-javadoc
apache-commons-codec
apache-commons-compress
plexus-interpolation
snakeyaml
eap7-snakeyaml (Red Hat package)
beust-jcommander
qdox
maven-doxia-sitetools
maven-doxia-sitetools-javadoc
maven-doxia-module-xdoc
maven-doxia-javadoc
maven-doxia-sink-api
maven-doxia-module-xhtml5
maven-doxia-module-fml
maven-doxia-test-docs
maven-doxia-module-apt
maven-doxia-core
cdi-api
jdom2
plexus-containers
plexus-velocity
plexus-velocity-javadoc
jansi
hamcrest
velocity-engine-core-javadoc
velocity-engine-core
plexus-classworlds
apache-commons-io
xmlunit
plexus-compiler
eap7-jackson-databind (Red Hat package)
univocity-parsers
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
maven-enforcer
maven-surefire
maven-antrun-plugin
maven-shared-io
maven-file-management
maven-dependency-tree
jsr-305
eap7-resteasy (Red Hat package)
maven-common-artifact-filters
maven-dependency-plugin
objenesis
eap7-apache-cxf (Red Hat package)
maven-filtering
maven-resources-plugin
maven-plugin-build-helper
plexus-io
maven-jar-plugin
maven-source-plugin
apache-commons-collections
eap7-hal-console (Red Hat package)
cglib
maven-assembly-plugin
plexus-utils
maven-plugin-testing
maven-invoker
maven-invoker-javadoc
maven-shared-utils
maven-wagon
maven-archiver
maven-surefire-provider-junit5
maven-surefire-provider-junit5-javadoc
maven-surefire-plugins-javadoc
maven-surefire-plugin
maven-failsafe-plugin
maven-surefire-report-plugin
maven-surefire-plugin-bootstrap
maven-surefire-report-plugin-bootstrap
maven-surefire-provider-testng
maven-surefire-provider-junit
maven-surefire-report-parser
maven-failsafe-plugin-bootstrap
maven-surefire-javadoc
maven-plugin-tools
maven
mockito
maven-compiler-plugin
maven-invoker-plugin-javadoc
maven-invoker-plugin
maven-dependency-plugin-javadoc
maven-javadoc-plugin-bootstrap
maven-javadoc-plugin-javadoc
maven-javadoc-plugin
apache-commons-lang3
maven-plugin-plugin-javadoc
maven-plugin-plugin
maven-plugin-plugin-bootstrap
maven-plugin-tools-java
maven-plugin-tools-api
maven-script-beanshell
maven-plugin-tools-javadoc
maven-script-ant
maven-plugin-annotations
maven-plugin-tools-annotations
maven-plugin-tools-ant
maven-plugin-tools-model
maven-plugin-tools-generators
maven-plugin-tools-beanshell
assertj-core
maven-reporting-api
maven-reporting-api-javadoc
maven-reporting-impl
maven-reporting-impl-javadoc
xmvn
eap7-netty (Red Hat package)
easymock
google-guice
plexus-archiver
httpcomponents-core
httpcomponents-client
junit
xbean
jakarta-servlet
maven-plugin-bundle
aqute-bnd
junit5
javapackages-tools
plexus-components-pom
osgi-compendium
eap7-wildfly (Red Hat package)
plexus-pom
testng
felix-parent
osgi-core
osgi-annotation
objectweb-asm
httpcomponents-project
apache-parent
guava
apache-resource-bundles
maven-parent
apache-commons-parent
mojo-parent
IBM Qradar SIEM

Install updates from vendor's website.

Apache Velocity Engine - update to 2.3
IBM Cloud Pak System - update to 2.3.3.6
IBM Intelligent Operations Center - update to 5.2.4
JBoss Enterprise Application Platform - addressed in versions 7.1.9, 7.3.12
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
velocity (Ubuntu package) - addressed in versions Ubuntu Pro, 1.7-5+deb9u1build0.20.04.1
plexus-build-api - update to 0.0.7-32.fc35
sisu - update to 0.3.4-5.fc35
sisu-mojos - update to 0.3.4-7.fc35
java_cup - update to 0.11b-17.fc35
maven-artifact-transfer - update to 0.13.1-2.fc35
atinject - update to 1.0.3-2.fc35
plexus-languages - update to 1.0.6-2.fc35
munge-maven-plugin - update to 1.0-20.fc35
plexus-resources - update to 1.1.0-6.fc35
apiguardian - update to 1.1.1-2.fc35
jdom - update to 1.1.3-25.fc35
maven-shared-incremental - update to 1.1-22.fc35
opentest4j - update to 1.2.0-6.fc35
apache-commons-logging - update to 1.2-26.fc35
jakarta-annotations - update to 1.3.5-8.fc35
eap7-jettison (Red Hat package) - addressed in versions 1.3.8-2.redhat_00002.1.ep7.el7, 1.5.2-2.redhat_00002.1.el7eap
apache-commons-jxpath - update to 1.3-39.fc35
apache-commons-cli - update to 1.4-13.fc35
plexus-sec-dispatcher - update to 1.4-33.fc35
maven-resolver - update to 1.6.1-2.fc35
eap7-velocity (Red Hat package) - update to 1.7.0-3.redhat_00006.1.ep7.el7
maven-remote-resources-plugin - update to 1.7.0-5.fc35
jflex - update to 1.7.0-6.fc35
velocity - update to 1.7-3.3.1
plexus-cipher - update to 1.7-23.fc35
velocity-help - update to 1.7-26
velocity - update to 1.7-26
slf4j - update to 1.7.30-9.fc35
velocity - update to 1.7-35.fc35
xz-java - update to 1.8-11.fc35
apache-commons-beanutils - update to 1.9.4-6.fc35
byte-buddy - update to 1.10.20-2.fc35
maven-dependency-analyzer - update to 1.11.3-3.fc35
modello - update to 1.11-5.fc35
felix-utils - update to 1.11.6-2.fc35
fusesource-pom - update to 1.12-7.fc35
jsoup - update to 1.13.1-6.fc35
maven-dependency-analyzer - update to 1.15.1-150200.3.10.3
maven-dependency-analyzer-javadoc - update to 1.15.1-150200.3.10.3
apache-commons-codec - update to 1.15-3.fc35
apache-commons-compress - update to 1.20-6.fc35
plexus-interpolation - update to 1.26-7.fc35
snakeyaml - update to 1.31-150200.12.6.1
eap7-snakeyaml (Red Hat package) - addressed in versions 1.33.0-1.SP1_redhat_00001.1.el7eap, 1.33.0-1.SP1_redhat_00001.1.ep7.el7
beust-jcommander - update to 1.78-6.fc35
qdox - update to 2.0.0-5.fc35
maven-doxia-sitetools - update to 2.0.0-150200.3.18.3
maven-doxia-sitetools-javadoc - update to 2.0.0-150200.3.18.3
maven-doxia-module-xdoc - update to 2.0.0-150200.4.18.11
maven-doxia-javadoc - update to 2.0.0-150200.4.18.11
maven-doxia-sink-api - update to 2.0.0-150200.4.18.11
maven-doxia-module-xhtml5 - update to 2.0.0-150200.4.18.11
maven-doxia-module-fml - update to 2.0.0-150200.4.18.11
maven-doxia-test-docs - update to 2.0.0-150200.4.18.11
maven-doxia-module-apt - update to 2.0.0-150200.4.18.11
maven-doxia-core - update to 2.0.0-150200.4.18.11
cdi-api - update to 2.0.2-2.fc35
jdom2 - update to 2.0.6-22.fc35
IBM Planning Analytics Workspace - addressed in versions 2.0.95, 2.1.2
plexus-containers - update to 2.1.0-6.fc35
plexus-velocity - update to 2.1.0-150200.3.10.3
plexus-velocity-javadoc - update to 2.1.0-150200.3.10.3
jansi - update to 2.1.1-4.fc35
hamcrest - update to 2.2-3.fc35
velocity-engine-core-javadoc - update to 2.4-150200.5.3.3
velocity-engine-core - update to 2.4-150200.5.3.3
Cloud Pak for Network Automation - update to 2.6.0
plexus-classworlds - update to 2.6.0-7.fc35
apache-commons-io - update to 2.8.0-4.fc35
xmlunit - update to 2.8.2-2.fc35
plexus-compiler - update to 2.8.8-2.fc35
eap7-jackson-databind (Red Hat package) - addressed in versions 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7, 2.10.4-4.redhat_00004.1.el7eap
univocity-parsers - update to 2.9.1-2.fc35
eap7-jackson-jaxrs-providers (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-core (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-modules-java8 (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-annotations (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-modules-base (Red Hat package) - update to 2.10.4-4.redhat_00004.1.el7eap
maven-enforcer - update to 3.0.0~M3-5.fc35
maven-surefire - update to 3.0.0~M4-2.fc35
maven-antrun-plugin - update to 3.0.0-2.fc35
maven-shared-io - update to 3.0.0-13.fc35
maven-file-management - update to 3.0.0-13.fc35
maven-dependency-tree - update to 3.0.1-7.fc35
jsr-305 - update to 3.0.2-2.fc35
eap7-resteasy (Red Hat package) - addressed in versions 3.0.27-1.Final_redhat_00001.1.ep7.el7, 3.11.6-1.Final_redhat_00001.1.el7eap
maven-common-artifact-filters - update to 3.1.1-2.fc35
maven-dependency-plugin - update to 3.1.2-6.fc35
objenesis - update to 3.1-6.fc35
eap7-apache-cxf (Red Hat package) - update to 3.1.16-4.redhat_00003.1.ep7.el7
maven-filtering - update to 3.2.0-2.fc35
maven-resources-plugin - update to 3.2.0-3.fc35
maven-plugin-build-helper - update to 3.2.0-4.fc35
plexus-io - update to 3.2.0-6.fc35
maven-jar-plugin - update to 3.2.0-6.fc35
maven-source-plugin - update to 3.2.1-5.fc35
apache-commons-collections - update to 3.2.2-23.fc35
eap7-hal-console (Red Hat package) - update to 3.2.17-1.Final_redhat_00001.1.el7eap
cglib - update to 3.3.0-3.fc35
maven-assembly-plugin - update to 3.3.0-5.fc35
plexus-utils - update to 3.3.0-6.fc35
maven-plugin-testing - update to 3.3.0-20.fc35
maven-invoker - update to 3.3.0-150200.3.7.5
maven-invoker-javadoc - update to 3.3.0-150200.3.7.5
maven-shared-utils - update to 3.3.3-2.fc35
maven-wagon - update to 3.4.2-2.fc35
maven-archiver - update to 3.5.1-2.fc35
maven-surefire-provider-junit5 - update to 3.5.2-150200.3.9.20.2
maven-surefire-provider-junit5-javadoc - update to 3.5.2-150200.3.9.20.2
maven-surefire-plugins-javadoc - update to 3.5.2-150200.3.9.20.2
maven-surefire-plugin - update to 3.5.2-150200.3.9.20.2
maven-failsafe-plugin - update to 3.5.2-150200.3.9.20.2
maven-surefire-report-plugin - update to 3.5.2-150200.3.9.20.2
maven-surefire - update to 3.5.2-150200.3.9.20.12
maven-surefire-plugin-bootstrap - update to 3.5.2-150200.3.9.20.12
maven-surefire-report-plugin-bootstrap - update to 3.5.2-150200.3.9.20.12
maven-surefire-provider-testng - update to 3.5.2-150200.3.9.20.12
maven-surefire-provider-junit - update to 3.5.2-150200.3.9.20.12
maven-surefire-report-parser - update to 3.5.2-150200.3.9.20.12
maven-failsafe-plugin-bootstrap - update to 3.5.2-150200.3.9.20.12
maven-surefire-javadoc - update to 3.5.2-150200.3.9.20.12
maven-plugin-tools - update to 3.6.0-9.fc35
maven - update to 3.6.3-9.fc35
mockito - update to 3.7.13-2.fc35
maven-compiler-plugin - update to 3.8.1-9.fc35
maven-invoker-plugin-javadoc - update to 3.8.1-150200.3.6.2
maven-invoker-plugin - update to 3.8.1-150200.3.6.2
maven-dependency-plugin-javadoc - update to 3.8.1-150200.3.10.2
maven-dependency-plugin - update to 3.8.1-150200.3.10.2
maven-javadoc-plugin-bootstrap - update to 3.11.1-150200.4.21.2
maven-javadoc-plugin-javadoc - update to 3.11.1-150200.4.21.2
maven-javadoc-plugin - update to 3.11.1-150200.4.21.2
apache-commons-lang3 - update to 3.12.0-2.fc35
maven-plugin-plugin-javadoc - update to 3.15.1-150200.3.15.2
maven-plugin-plugin - update to 3.15.1-150200.3.15.2
maven-plugin-plugin-bootstrap - update to 3.15.1-150200.3.15.2
maven-plugin-tools-java - update to 3.15.1-150200.3.15.12
maven-plugin-tools-api - update to 3.15.1-150200.3.15.12
maven-script-beanshell - update to 3.15.1-150200.3.15.12
maven-plugin-tools-javadoc - update to 3.15.1-150200.3.15.12
maven-script-ant - update to 3.15.1-150200.3.15.12
maven-plugin-annotations - update to 3.15.1-150200.3.15.12
maven-plugin-tools-annotations - update to 3.15.1-150200.3.15.12
maven-plugin-tools-ant - update to 3.15.1-150200.3.15.12
maven-plugin-tools-model - update to 3.15.1-150200.3.15.12
maven-plugin-tools-generators - update to 3.15.1-150200.3.15.12
maven-plugin-tools-beanshell - update to 3.15.1-150200.3.15.12
assertj-core - update to 3.19.0-2.fc35
maven-reporting-api - update to 4.0.0-150200.3.10.12
maven-reporting-api-javadoc - update to 4.0.0-150200.3.10.12
maven-reporting-impl - update to 4.0.0-150200.4.9.12
maven-reporting-impl-javadoc - update to 4.0.0-150200.4.9.12
xmvn - update to 4.0.0~20191028.da67577-6.fc35
QRadar User Behavior Analytics - update to 4.1.16
eap7-netty (Red Hat package) - addressed in versions 4.1.63-1.Final_redhat_00002.1.ep7.el7, 4.1.63-4.Final_redhat_00002.1.el7eap
easymock - update to 4.2-3.fc35
google-guice - update to 4.2.3-5.fc35
plexus-archiver - update to 4.2.4-2.fc35
httpcomponents-core - update to 4.4.13-3.fc35
httpcomponents-client - update to 4.5.11-3.fc35
IBM Match 360 - update to 4.7.1
junit - update to 4.13.1-2.fc35
xbean - update to 4.18-2.fc35
jakarta-servlet - update to 5.0.0-6.fc35
maven-plugin-bundle - update to 5.1.1-2.fc35
aqute-bnd - update to 5.2.0-2.fc35
junit5 - update to 5.7.1-2.fc35
javapackages-tools - update to 6.0.0~alpha-6.fc35
IBM Sterling External Authentication Server - addressed in versions 6.0.3.0 iFix 08, 6.1.0.0 iFix 04
UrbanCode Build - update to 6.1.7.10
IBM UrbanCode Release - update to 6.2.5.11
plexus-components-pom - update to 6.5-3.fc35
osgi-compendium - update to 7.0.0-9.fc35
Jazz Foundation - update to 7.0.2.0.29
Engineering Lifecycle Management - Jazz Foundation - addressed in versions 7.0.3 iFix022, 7.1.0 iFix008
Engineering Test Management - addressed in versions 7.0.3.0.22, 7.1.0.8
eap7-wildfly (Red Hat package) - addressed in versions 7.1.9-2.GA_redhat_00002.1.ep7.el7, 7.3.12-3.GA_redhat_00002.1.el7eap
plexus-pom - update to 7-2.fc35
testng - update to 7.3.0-2.fc35
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5
felix-parent - update to 7-5.fc35
osgi-core - update to 8.0.0-2.fc35
osgi-annotation - update to 8.0.0-2.fc35
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.1.20.0
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.1.20.0
objectweb-asm - update to 9.1-2.fc35
httpcomponents-project - update to 12-3.fc35
apache-parent - update to 23-5.fc35
guava - update to 30.1-2.fc35
apache-resource-bundles - update to 30-2.fc35
maven-parent - update to 34-7.fc35
maven-parent - update to 43-150200.3.8.2
apache-commons-parent - update to 52-3.fc35
mojo-parent - update to 60-2.fc35

• http://www.openwall.com/lists/oss-security/2021/03/10/1
• https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E
• https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a@%3Cuser.velocity.apache.org%3E
• https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6@%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6@%3Ccommits.velocity.apache.org%3E

• Remote code injection in Apache Velocity Engine
• Gentoo update for Apache Velocity
• Multiple vulnerabilities in Oracle Utilities Testing Accelerator
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Retail Service Backbone
• Multiple vulnerabilities in Oracle Retail Order Broker
• Multiple vulnerabilities in Oracle Retail Integration Bus
• Multiple vulnerabilities in Oracle Banking Platform
• Multiple vulnerabilities in Oracle Banking Party Management
• Code Injection in Oracle Banking Loans Servicing
• Multiple vulnerabilities in Oracle Banking Enterprise Default Management
• Code Injection in Oracle Banking Deposits and Lines of Credit Servicing
• Multiple vulnerabilities in Oracle Communications Network Integrity
• Multiple vulnerabilities in Oracle Hospitality Token Proxy Service
• Code Injection in Oracle Retail Xstore Office Cloud Service
• SUSE update for snakeyaml
• Multiple vulnerabilities in Oracle Communications User Data Repository
• Code Injection in Oracle Identity Management Suite
• SUSE update for velocity
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in Oracle Utilities Application Framework
• Multiple vulnerabilities in IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• Ubuntu update for velocity
• Code injection in IBM Match 360
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Code Injection in IBM Intelligent Operations Center (IOC)
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM UrbanCode Release
• Multiple vulnerabilities in IBM UrbanCode Build
• Multiple vulnerabilities in IBM Storage Protect for Virtual Environments
• openEuler 20.03 LTS SP1 update for velocity
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Code injection in IBM Jazz Foundation
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Fedora 35 update for apache-commons-beanutils, apache-commons-cli, apache-commons-codec, apache-commons-collections, apache-commons-compress, apache-commons-io, apache-commons-jxpath, apache-commons-lang3, apache-commons-logging, apache-commons-parent, ap
• SUSE update for Recommended update for Maven
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
• Code Injection in Oracle WebLogic Server
• Code Injection in Oracle GoldenGate Studio
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• Multiple vulnerabilities in Oracle Banking Digital Experience
• Multiple vulnerabilities in Oracle Banking APIs
• IBM Engineering Test Management update for Apache-Velocity
• IBM Engineering Lifecycle Management - Jazz Foundation update for Apache Velocity library