Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

57 records

Vendor: Oracle Component: Retail Customer Management And Segmentation Foundation Clear all filters
TI-2022-07142 CVE-2022-22965 · GHSA-36p3-wjmg-h94x

Code injection in Spring Framework

Priority CRITICAL 100KEV

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99638 Published 2022-04-01 Partial fix · 5.2.20.RELEASE, 5.3.18 +2 CWE-94
TI-2021-10677 CVE-2021-30129 · GHSA-9279-7hph-r3xw

DoS/OOM leak vulnerability in Apache Mina SSHD Server

Priority LOW 34

A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03049 Published 2021-07-12 Partial fix · 2.7.0 CWE-772
TI-2021-05110 CVE-2021-22118 · GHSA-gfwj-fwqj-fp3v

Improper privilege management in Spring Framework

Priority LOW 34

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticat…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00381 Published 2021-05-27 Partial fix · 5.2.15, 5.3.7 CWE-269
TI-2021-06035 CVE-2021-23337 · GHSA-35jh-r3h4-6jhm

Command injection in Lodash

Priority MEDIUM 59

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.21333 Published 2021-02-15 Partial fix · 4.17.21 CWE-94
TI-2020-17303 CVE-2020-28500 · GHSA-29mw-wpgm-hmr9

Regular expression denial of service (ReDoS) in Lodash

Priority MEDIUM 40

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.07336 Published 2021-02-15 Partial fix · 4.17.21 CWE-1333
TI-2020-18508 CVE-2020-36188 · GHSA-f9xh-2qgp-cq57

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

Priority MEDIUM 55

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.08787 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502
TI-2020-18509 CVE-2020-36189 · GHSA-vfqx-33qm-g869

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

Priority MEDIUM 50

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.03987 Published 2021-01-06 Partial fix · 2.9.10.8, 2.6.7.5 CWE-502
TI-2020-18187 CVE-2020-35728 · GHSA-5r5r-6hpj-8gg9

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between…

Priority MEDIUM 51

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.12405 Published 2020-12-27 Partial fix · 2.9.10.8 CWE-502
TI-2020-07155 CVE-2020-8908 · GHSA-5mg8-w23w-74h3

Temp directory permission issue in Guava

Priority LOW 18

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.F…

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00924 Published 2020-12-10 Partial fix · 32.0, 32.0.0-android CWE-378
Load more