oracle global lifecycle management opatch vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv3

Apache Thrift Java client library versions 0.5.0 up to and including 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in...

Apache Thrift Debian Debian Linux 8.0 F5 Traffix Signaling Delivery Controller Oracle Global Lifecycle Management Opatch Oracle Nosql Database

6.5

CVSSv3

Fasterxml Jackson version prior to 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very la...

Fasterxml Jackson-modules-java8 Oracle Database Server 12.1.0.2 Oracle Database Server 12.2.0.1 Oracle Database Server 18c Oracle Database Server 19c Oracle Clusterware 12.1.0.2.0 Oracle Global Lifecycle Management Opatch Oracle Nosql Database Netapp Active Iq Unified Manager

9.8

CVSSv3

An issue exists in FasterXML jackson-databind 2.0.0 up to and including 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

Fasterxml Jackson-databind Redhat Openshift Container Platform 3.11 Redhat Openshift Container Platform 4.1 Oracle Retail Customer Management And Segmentation Foundation 17.0 Oracle Clusterware 12.1.0.2.0 Oracle Global Lifecycle Management Opatch Oracle Utilities Advanced Spatial And Operational Analytics 2.7.0.1 Oracle Communications Instant Messaging Server 10.0.1.2.0

7.5

CVSSv3

A Polymorphic Typing issue exists in FasterXML jackson-databind 2.x prior to 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

2 Github repositories

9.8

CVSSv3

FasterXML jackson-databind 2.0.0 up to and including 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Fasterxml Jackson-databind Debian Debian Linux 8.0 Netapp Steelstore Cloud Integrated Storage -Netapp Oncommand Workflow Automation -Netapp Service Level Manager -Netapp Oncommand Api Services -Huawei Oceanstor 9000 Firmware V300r006c20 Huawei Oceanstor 9000 Firmware V300r006c20spc100 Huawei Oceanstor 9000 Firmware V300r006c20spc200 Huawei Oceanstor 9000 Firmware V300r006c20spc300 Oracle Global Lifecycle Management Opatch

9 Github repositories

6.5

CVSSv3

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulner...

Apache Xerces-j Oracle Ilearning 6.2 Oracle Flexcube Universal Banking 12.4.0 Oracle Weblogic Server 12.2.1.3.0 Oracle Agile Plm 9.3.6 Oracle Weblogic Server 12.2.1.4.0 Oracle Peoplesoft Enterprise Peopletools 8.58 Oracle Weblogic Server 14.1.1.0.0 Oracle Retail Bulk Data Integration 16.0.3.0 Oracle Retail Merchandising System 16.0.3 Oracle Global Lifecycle Management Nextgen Oui Framework 13.9.4.2.2 Oracle Agile Engineering Data Management 6.2.1.0 Oracle Retail Service Backbone 16.0.3 Oracle Retail Financial Integration 16.0.3 Oracle Retail Integration Bus 16.0.3 Oracle Peoplesoft Enterprise Peopletools 8.59 Oracle Retail Service Backbone 15.0.3.1 Oracle Retail Service Backbone 14.1.3.2 Oracle Financial Services Enterprise Case Management 8.0.7.2.0 Oracle Banking Party Management 2.7.0 Oracle Retail Merchandising System 19.0.1 Oracle Retail Integration Bus 14.1.3.2

9.8

CVSSv3

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Fasterxml Jackson-databind Netapp Active Iq Unified Manager Debian Debian Linux 8.0 Oracle Retail Xstore Point Of Service 15.0 Oracle Primavera Unifier 16.2 Oracle Primavera Unifier 16.1 Oracle Weblogic Server 12.2.1.3.0 Oracle Retail Xstore Point Of Service 16.0 Oracle Primavera Unifier 18.8 Oracle Primavera Unifier Oracle Weblogic Server 12.2.1.4.0 Oracle Enterprise Manager Base Platform 13.3.0.0 Oracle Primavera Unifier 19.12 Oracle Enterprise Manager Base Platform 13.4.0.0 Oracle Communications Instant Messaging Server 10.0.1.4.0 Oracle Retail Xstore Point Of Service 17.0 Oracle Retail Xstore Point Of Service 18.0 Oracle Retail Xstore Point Of Service 19.0 Oracle Communications Evolved Communications Application Server 7.1 Oracle Communications Network Charging And Control 6.0.1 Oracle Jd Edwards Enterpriseone Tools Oracle Jd Edwards Enterpriseone Orchestrator

1 Github repository

7.5

CVSSv3

jackson-databind prior to 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

4 Github repositories

9.8

CVSSv3

A Polymorphic Typing issue exists in FasterXML jackson-databind prior to 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

1 Github repository

6.5

CVSSv3

RSA BSAFE Crypto-J versions before 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook