Vulnerabilities

TI-2021-15570 CVE-2021-37695 · GHSA-m94c-37g6-cjhc

Execution of JavaScript code using malformed HTML in ckeditor

LOW 35

ckeditor is an open source WYSIWYG HTML editor with rich content support.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.01318 Published 2021-08-12 Fixed in 4.16.2 CWE-79

TI-2021-12474 CVE-2021-32809 · GHSA-7889-rm5j-hpgg

Arbitrary HTML injection vulnerability in ckeditor

LOW 27

ckeditor is an open source WYSIWYG HTML editor with rich content support.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01188 Published 2021-08-12 Fixed in 4.16.2 CWE-94

TI-2021-12473 CVE-2021-32808 · GHSA-6226-h7ff-ch6c

Cross-site scripting in ckeditor via abuse of undo functionality

LOW 36

ckeditor is an open source WYSIWYG HTML editor with rich content support.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.01192 Published 2021-08-12 Fixed in 4.16.2 CWE-79

TI-2021-02021 CVE-2021-2351 · GHSA-gm3p-p24r-4wxq

Broken or risky cryptographic algorithm in Oracle WebLogic Server

MEDIUM 41

Vulnerability in the Advanced Networking Option component of Oracle Database Server.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.02432 Published 2021-07-20 No fix listed CWE-327

TI-2021-05110 CVE-2021-22118 · GHSA-gfwj-fwqj-fp3v

Improper privilege management in Spring Framework

LOW 34

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticat…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00381 Published 2021-05-27 Partial fix · 5.2.15, 5.3.7 CWE-269

TI-2020-18500 CVE-2020-36180 · GHSA-8c4j-34r4-xr8g

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 47

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.04092 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502

TI-2020-18502 CVE-2020-36182 · GHSA-89qr-369f-5m5x

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 47

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.04092 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502

TI-2020-18503 CVE-2020-36183 · GHSA-9m6f-7xcq-8vf8

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 51

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.04931 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502

TI-2020-18504 CVE-2020-36184 · GHSA-m6x4-97wx-4q27

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 51

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.08356 Published 2021-01-06 Partial fix · 2.9.10.8 CWE-502

TI-2020-18505 CVE-2020-36185 · GHSA-8w26-6f25-cm9x

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 50

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.04237 Published 2021-01-06 Partial fix · 2.9.10.8 CWE-502

TI-2020-18506 CVE-2020-36186 · GHSA-v585-23hc-c647

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 50

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.04237 Published 2021-01-06 Partial fix · 2.9.10.8 CWE-502

TI-2020-18507 CVE-2020-36187 · GHSA-r695-7vr9-jgc2

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 50

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.04237 Published 2021-01-06 Partial fix · 2.9.10.8 CWE-502

TI-2020-18508 CVE-2020-36188 · GHSA-f9xh-2qgp-cq57

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 55

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.08787 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502

TI-2020-18509 CVE-2020-36189 · GHSA-vfqx-33qm-g869

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 50

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.03987 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502

TI-2020-18501 CVE-2020-36181 · GHSA-cvm9-fjm9-3572

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 47

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.04092 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502

TI-2020-18012 CVE-2020-35490 · GHSA-wh8g-3j2c-rqj5

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 52

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.06285 Published 2020-12-17 Partial fix · 2.9.10.8 CWE-502

TI-2020-18013 CVE-2020-35491 · GHSA-r3gr-cxrf-hg25

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

MEDIUM 54

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0775 Published 2020-12-17 Partial fix · 2.9.10.8 CWE-502

TI-2020-08586 CVE-2020-10683 · GHSA-hwj3-m3p6-hj38

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by…

MEDIUM 52

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07269 Published 2020-05-01 Partial fix · 2.0.3, 2.1.3 CWE-611

TI-2020-04314 CVE-2020-5258 · GHSA-jxfh-8wgv-vfr2

Prototype pollution in dojo

MEDIUM 42

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.04023 Published 2020-03-10 Fixed in 1.12.8, 1.13.7 +4 CWE-94

TI-2019-07539 CVE-2019-10219 · GHSA-m8p2-495h-ccmh

Cross-site scripting in hibernate-validator

LOW 31

A vulnerability was found in Hibernate-Validator.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02157 Published 2019-11-08 Partial fix · 6.0.18.Final, 6.1.0.Final +1 CWE-79

TI-2019-10436 CVE-2019-13990 · GHSA-9qcf-c26r-x5rf

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler…

HIGH 66

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.16628 Published 2019-07-26 Partial fix · 2.3.2 CWE-611

TI-2019-03837 CVE-2019-5427 · GHSA-84p2-vf58-xhxv

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML…

MEDIUM 41

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04882 Published 2019-04-22 Partial fix · 0.9.5.4 CWE-776

TI-2016-00569 CVE-2016-0635 · GHSA-7gph-3vpp-prg4

Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle…

MEDIUM 48

Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component in Oracle Health Sci…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.05077 Published 2016-07-21 No fix listed

Vulnerabilities

Filters