Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

12 records

Vendor: Oracle Component: Retail Bulk Data Integration Clear all filters
TI-2022-07142 CVE-2022-22965 · GHSA-36p3-wjmg-h94x

Code injection in Spring Framework

Priority CRITICAL 100KEV

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99638 Published 2022-04-01 Partial fix · 5.2.20.RELEASE, 5.3.18 +2 CWE-94
TI-2022-07499 CVE-2022-23437 · GHSA-h65f-jvqw-m9fj

Infinite loop within Apache XercesJ xml parser

Priority MEDIUM 42

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.11615 Published 2022-01-24 Partial fix · 2.12.2 CWE-835
TI-2021-17647 CVE-2021-40690 · GHSA-j8wc-gxx9-82hx

Bypass of the secureValidation property

Priority MEDIUM 49

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference e…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07441 Published 2021-09-19 Partial fix · 2.2.3,2.1.7, 2.2.3 +1 CWE-200
TI-2021-14728 CVE-2021-36374 · GHSA-5v34-g2px-j4fw

Apache Ant ZIP, and ZIP based, archive denial of service vulerability

Priority LOW 30

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.02642 Published 2021-07-14 Partial fix · 1.9.16, 1.10.11 CWE-130
TI-2021-14727 CVE-2021-36373 · GHSA-q5r4-cfpx-h6fh

Apache Ant TAR archive denial of service vulnerability

Priority LOW 30

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.02532 Published 2021-07-14 Partial fix · Apache Ant, 1.9.16 +1 CWE-130
TI-2020-04467 CVE-2020-5421 · GHSA-rv39-3qh7-9v7w

RFD Protection Bypass via jsessionid

Priority MEDIUM 42

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.11564 Published 2020-09-19 Partial fix · 4.3.29, 5.0.19 +2 CWE-35
TI-2020-01869 CVE-2020-1945 · GHSA-4p6w-m9wc-c9c9

Exposure of resource to wrong sphere in Apache Ant

Priority LOW 32

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.01769 Published 2020-05-14 Partial fix · 1.9.15, 1.10.8 CWE-668
TI-2020-07597 CVE-2020-9488 · GHSA-vwqq-5vrc-xw9h

Improper certificate validation in Apache Log4j

Priority LOW 29

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.08216 Published 2020-04-27 Partial fix · 2.12.3, 2.13.2 +1 CWE-295
TI-2020-04444 CVE-2020-5398 · GHSA-8wx2-9q48-vm9r

RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

Priority HIGH 77

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Dispo…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.88322 Published 2020-01-16 Partial fix · v5.0.16.RELEASE, v5.1.13.RELEASE +4 CWE-79
TI-2019-12748 CVE-2019-17091 · GHSA-rjhx-c9qh-qh8f

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for…

Priority LOW 32

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02469 Published 2019-10-02 Fixed in 2.2.20, 2.3.10 CWE-79