Priority LOW 26
Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Web UI).
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00168 · Published 2025-01-21 · No fix listed CWE-352
Priority LOW 21
Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Application).
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00487 · Published 2023-04-18 · No fix listed
Priority CRITICAL 100KEV
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99638 · Published 2022-04-01 · Partial fix · 5.2.20.RELEASE, 5.3.18 +2 CWE-94
Priority CRITICAL 100KEV
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in rem…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99938 · Published 2022-04-01 · Fixed in 3.2.3, 3.1.7 CWE-94
Priority LOW 38
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02487 · Published 2022-03-16 · Fixed in 4.18.0 CWE-400
Priority LOW 27
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01203 · Published 2022-03-16 · Fixed in 4.18.0 CWE-79
Priority MEDIUM 47
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0486 · Published 2022-03-11 · Partial fix · 2.13.2.1, 2.12.6.1 CWE-787
Priority MEDIUM 42
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.11615 · Published 2022-01-24 · Partial fix · 2.12.2 CWE-835
Priority LOW 36
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.06201 · Published 2021-09-22 · Partial fix · 2.6.3, 2.7.2 +1 CWE-203
Priority MEDIUM 41
Vulnerability in the Advanced Networking Option component of Oracle Database Server.
CVSS 3.1HIGH 8.3· Network · No auth · User interaction · EPSS 0.02432 · Published 2021-07-20 · No fix listed CWE-327
Priority LOW 31
A vulnerability was found in Hibernate-Validator.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02157 · Published 2019-11-08 · Partial fix · 6.0.18.Final, 6.1.0.Final +1 CWE-79
Priority CRITICAL 91
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, c…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.89358 · Published 2017-04-17 · Partial fix · 2.8.2 CWE-502
THREATIST.IORead the docs