Priority HIGH 73
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.54411 · Published 2022-01-18 · Partial fix CWE-502
Priority CRITICAL 85
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.66537 · Published 2022-01-18 · Partial fix · 2.0-alpha1 CWE-89
Priority HIGH 76
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has ac…
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.63841 · Published 2022-01-18 · Partial fix · 2.0-alpha1 CWE-502
Priority HIGH 73
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.80599 · Published 2021-12-14 · Partial fix CWE-502
Priority HIGH 76
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.
CVSS 3.1HIGH 7.5· Adjacent network · No auth · No interaction · EPSS 0.9194 · Published 2019-05-01 · Will not fix CWE-918
Priority LOW 28
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVSS 3.1MEDIUM 4.7· Local · Low privileges · No interaction · EPSS 0.03418 · Published 2018-11-15 · Partial fix CWE-200
Priority MEDIUM 46
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.12154 · Published 2018-10-30 · Partial fix CWE-327
Priority MEDIUM 40
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.04724 · Published 2018-10-29 · Partial fix CWE-327
Priority MEDIUM 40
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.10554 · Published 2018-08-02 · Will not fix CWE-79
Priority MEDIUM 48
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core).
CVSS 3.0HIGH 8.6· Network · No auth · No interaction · EPSS 0.02675 · Published 2018-07-18 · No fix listed
Priority LOW 33
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Security).
CVSS 3.0HIGH 7.0· Network · No auth · No interaction · EPSS 0.00955 · Published 2017-11-14 · No fix listed
Priority MEDIUM 45
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core).
CVSS 3.0CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.01231 · Published 2017-11-14 · No fix listed
Priority MEDIUM 53
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core).
CVSS 3.0CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.0216 · Published 2017-11-14 · No fix listed
Priority MEDIUM 42
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core).
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01476 · Published 2017-11-14 · No fix listed CWE-200
Priority LOW 32
Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core).
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01083 · Published 2017-11-14 · No fix listed CWE-200
Priority LOW 39
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by perfor…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.10731 · Published 2016-02-15 · Partial fix CWE-200
THREATIST.IORead the docs