Priority CRITICAL 91
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, c…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.89358 · Published 2017-04-17 · Partial fix · 2.8.2 CWE-502
Priority HIGH 71
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.26587 · Published 2020-02-10 · Partial fix · 2.6.7.4, 2.7.9.7 +2 CWE-502
Priority MEDIUM 62
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10763 · Published 2019-09-15 · Partial fix · 2.9.10, 2.8.11.5 +1 CWE-502
Priority MEDIUM 59
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0864 · Published 2020-01-03 · Partial fix · 2.6.7.4, 2.7.9.7 +2 CWE-502
Priority MEDIUM 57
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05681 · Published 2019-10-01 · Partial fix · 2.9.10.1, 2.8.11.5 +1 CWE-502
Priority MEDIUM 57
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04918 · Published 2019-09-15 · Partial fix · 2.9.10, 2.8.11.5 +1 CWE-502
Priority MEDIUM 56
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.17714 · Published 2020-12-03 · Partial fix · 2.6.7.4, 2.9.10.7 +1 CWE-611
Priority MEDIUM 56
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04741 · Published 2019-10-01 · Partial fix · 2.9.10.1, 2.8.11.5 +1 CWE-502
Priority MEDIUM 56
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction wi…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04091 · Published 2020-03-02 · Partial fix · 2.9.10 CWE-200
Priority MEDIUM 52
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07269 · Published 2020-05-01 · Partial fix · 2.0.3, 2.1.3 CWE-611
Priority MEDIUM 50
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.18891 · Published 2021-03-09 · Partial fix · 4.1.60.Final CWE-444
Priority MEDIUM 50
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04628 · Published 2019-10-06 · Partial fix · 2.9.10, 2.8.11.5 CWE-502
Priority MEDIUM 48
A flaw was found in jackson-databind before 2.9.10.7.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.07573 · Published 2021-01-19 · Partial fix · 2.9.10.7, 2.6.7.5 CWE-502
Priority MEDIUM 45
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.09188 · Published 2020-04-07 · Partial fix · 4.1.46 CWE-770
Priority MEDIUM 44
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0877 · Published 2019-10-08 · Fixed in 1.64 CWE-770
Priority MEDIUM 44
An issue has been found in third-party PNM decoding associated with libpng 1.6.35.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.03541 · Published 2019-07-10 · Fixed in 1.6.37 CWE-787
Priority MEDIUM 40
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.04935 · Published 2021-03-30 · Partial fix · 4.1.61.Final CWE-444
Priority LOW 34
All versions of OnCommand API Services prior to 2.1 and NetApp Service Level Manager prior to 1.0RC4 log a privileged database user account password.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00339 · Published 2018-02-23 · No fix listed CWE-200
Priority LOW 32
NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND password when a user attempts to log in using the REST API, which allows remote authenticated users to obtain sensitive password information via unspecified v…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01337 · Published 2017-07-25 · No fix listed
THREATIST.IORead the docs