Vulnerabilities

TI-2020-08896 CVE-2020-11022 · GHSA-gxr4-xjj5-5px2

jQuery has a potential XSS vulnerability

HIGH 75

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.99215 Published 2020-04-29 Partial fix · 3.5.0, 4.4.0 +2 CWE-79

TI-2020-07597 CVE-2020-9488 · GHSA-vwqq-5vrc-xw9h

Improper certificate validation in Apache Log4j

LOW 29

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.08216 Published 2020-04-27 Partial fix · 2.12.3, 2.13.2 +1 CWE-295

TI-2020-02637 CVE-2020-2942 · GHSA-2677-vh42-vx74

Vulnerability in the Oracle Financial Services Price Creation and Discovery product of…

LOW 33

Vulnerability in the Oracle Financial Services Price Creation and Discovery product of Oracle Financial Services Applications (component: User Interface).

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.01051 Published 2020-04-15 No fix listed

TI-2020-08984 CVE-2020-11112 · GHSA-58pp-9c76-5625

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between…

MEDIUM 46

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03643 Published 2020-03-31 Partial fix · 2.9.10.4 CWE-502

TI-2020-08985 CVE-2020-11113 · GHSA-9vvp-fxw6-jcxr

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between…

MEDIUM 49

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.06278 Published 2020-03-31 Partial fix · 2.9.10.4 CWE-502

TI-2020-08845 CVE-2020-10968 · GHSA-rf6r-2c4q-2vwg

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between…

MEDIUM 46

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03656 Published 2020-03-26 Partial fix · 2.9.10.4 CWE-502

TI-2020-08846 CVE-2020-10969 · GHSA-758m-v56v-grj4

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between…

MEDIUM 46

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0356 Published 2020-03-26 Partial fix · 2.9.10.4 CWE-502

TI-2020-08578 CVE-2020-10672 · GHSA-95cm-88f5-f2c7

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between…

MEDIUM 46

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jm…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03059 Published 2020-03-18 Partial fix · 2.9.10.4 CWE-502

TI-2020-08579 CVE-2020-10673 · GHSA-fqwf-pjwf-7vqv

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between…

MEDIUM 51

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.07963 Published 2020-03-18 Partial fix · 2.9.10.4, 2.6.7.4 CWE-502

TI-2020-07634 CVE-2020-9546 · GHSA-5p34-5m6p-p58g

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between…

MEDIUM 49

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04575 Published 2020-03-02 Partial fix · 2.9.10.4 CWE-502

TI-2019-08480 CVE-2019-11358 · GHSA-6c3j-c64m-qhgq

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles…

HIGH 69

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.8682 Published 2019-04-19 Partial fix · 3.4.0, 4.3.4 +3 CWE-1321

TI-2018-02041 CVE-2018-2722 · GHSA-5v3w-6m5m-92vj

Vulnerability in the Oracle Financial Services Price Creation and Discovery component of…

LOW 29

Vulnerability in the Oracle Financial Services Price Creation and Discovery component of Oracle Financial Services Applications (subcomponent: User Interface).

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01098 Published 2018-01-18 No fix listed

TI-2018-02040 CVE-2018-2721 · GHSA-cgcw-5935-5p78

Vulnerability in the Oracle Financial Services Price Creation and Discovery component of…

MEDIUM 40

Vulnerability in the Oracle Financial Services Price Creation and Discovery component of Oracle Financial Services Applications (subcomponent: User Interface).

CVSS 3.0HIGH 8.1 Network Low privileges No interaction EPSS 0.01506 Published 2018-01-18 No fix listed

Vulnerabilities

Filters