Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

50 records

Vendor: Oracle Component: Communications Policy Management Clear all filters
TI-2022-07142 CVE-2022-22965 · GHSA-36p3-wjmg-h94x

Code injection in Spring Framework

Priority CRITICAL 100KEV

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99638 Published 2022-04-01 Partial fix · 5.2.20.RELEASE, 5.3.18 +2 CWE-94
TI-2021-06141 CVE-2021-23450 · GHSA-m8gw-hjpr-rjv7

Prototype pollution in dojo

Priority HIGH 72

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.30367 Published 2021-12-17 No fix listed CWE-1321
TI-2021-19417 CVE-2021-43527 · GHSA-7hfm-39v6-v3p5

Out-of-bounds write in Mozilla NSS

Priority MEDIUM 59

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.17563 Published 2021-12-08 Fixed in 3.73, 3.68.1 CWE-787
TI-2021-12641 CVE-2021-33037 · GHSA-4vww-mc66-62m6

Incorrect Transfer-Encoding handling with HTTP/1.0

Priority HIGH 69

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.74667 Published 2021-07-12 Partial fix · 10.0.7, 9.0.48 +1 CWE-444
TI-2021-10139 CVE-2021-29425 · GHSA-gwrp-pvrq-jmwv

Possible limited path traversal vulnerabily in Apache Commons IO

Priority MEDIUM 48

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.10549 Published 2021-04-13 Partial fix · 2.7 CWE-20
TI-2021-04449 CVE-2021-21349 · GHSA-f6hm-88x3-mfjv

Deserialization of untrusted data in xstream

Priority HIGH 73

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.46826 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-04442 CVE-2021-21342 · GHSA-hvv8-336g-rx3m

Deserialization of untrusted data in xstream

Priority HIGH 76

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.4999 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-04443 CVE-2021-21343 · GHSA-74cv-f58x-f9wf

Deserialization of untrusted data in xstream

Priority HIGH 69

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.46666 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2020-18508 CVE-2020-36188 · GHSA-f9xh-2qgp-cq57

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

Priority MEDIUM 55

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.08787 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502
Load more