oracle primavera unifier 15.0 vulnerabilities and exploits

(subscribe to this query)

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Platform). Supported versions that are affected are 10.x, 15.x, 16.x and 17.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP...

Oracle Primavera Unifier 16.2 Oracle Primavera Unifier 15.0 Oracle Primavera Unifier 16.0 Oracle Primavera Unifier 16.1 Oracle Primavera Unifier 17.0 Oracle Primavera Unifier 15.1 Oracle Primavera Unifier 15.2 Oracle Primavera Unifier 10.0 Oracle Primavera Unifier 10.1

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

1 Github repository

A Polymorphic Typing issue exists in FasterXML jackson-databind prior to 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

2 Github repositories

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Fasterxml Jackson-databind Netapp Active Iq Unified Manager Debian Debian Linux 8.0 Oracle Retail Xstore Point Of Service 15.0 Oracle Primavera Unifier 16.2 Oracle Primavera Unifier 16.1 Oracle Weblogic Server 12.2.1.3.0 Oracle Retail Xstore Point Of Service 16.0 Oracle Primavera Unifier 18.8 Oracle Primavera Unifier Oracle Weblogic Server 12.2.1.4.0 Oracle Enterprise Manager Base Platform 13.3.0.0 Oracle Primavera Unifier 19.12 Oracle Enterprise Manager Base Platform 13.4.0.0 Oracle Communications Instant Messaging Server 10.0.1.4.0 Oracle Retail Xstore Point Of Service 17.0 Oracle Retail Xstore Point Of Service 18.0 Oracle Retail Xstore Point Of Service 19.0 Oracle Communications Evolved Communications Application Server 7.1 Oracle Communications Network Charging And Control 6.0.1 Oracle Jd Edwards Enterpriseone Tools Oracle Jd Edwards Enterpriseone Orchestrator

1 Github repository

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

SubTypeValidator.java in FasterXML jackson-databind prior to 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

1 Github repository

FasterXML jackson-databind 2.x prior to 2.9.7 might allow remote malicious users to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Fasterxml Jackson-databind 2.7.0 Fasterxml Jackson-databind Fasterxml Jackson-databind 2.8.0 Fasterxml Jackson-databind 2.9.0 Debian Debian Linux 8.0 Debian Debian Linux 9.0 Oracle Primavera Unifier 16.2 Oracle Banking Platform 2.5.0 Oracle Primavera Unifier 16.1 Oracle Jdeveloper 12.1.3.0.0 Oracle Retail Merchandising System 16.0 Oracle Webcenter Portal 12.2.1.3.0 Oracle Primavera Unifier Oracle Communications Billing And Revenue Management 7.5 Oracle Communications Billing And Revenue Management 12.0 Oracle Financial Services Analytical Applications Infrastructure 8.0.2 Oracle Financial Services Analytical Applications Infrastructure 8.0.3 Oracle Financial Services Analytical Applications Infrastructure 8.0.4 Oracle Financial Services Analytical Applications Infrastructure 8.0.5 Oracle Financial Services Analytical Applications Infrastructure 8.0.6 Oracle Financial Services Analytical Applications Infrastructure 8.0.7 Oracle Banking Platform 2.6.0

FasterXML jackson-databind 2.x prior to 2.9.7 might allow malicious users to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Fasterxml Jackson-databind 2.7.0 Fasterxml Jackson-databind Fasterxml Jackson-databind 2.8.0 Fasterxml Jackson-databind 2.9.0 Debian Debian Linux 8.0 Debian Debian Linux 9.0 Oracle Primavera Unifier 16.2 Oracle Banking Platform 2.5.0 Oracle Primavera Unifier 16.1 Oracle Jdeveloper 12.1.3.0.0 Oracle Retail Merchandising System 16.0 Oracle Webcenter Portal 12.2.1.3.0 Oracle Primavera Unifier Oracle Communications Billing And Revenue Management 7.5 Oracle Communications Billing And Revenue Management 12.0 Oracle Financial Services Analytical Applications Infrastructure 8.0.2 Oracle Financial Services Analytical Applications Infrastructure 8.0.3 Oracle Financial Services Analytical Applications Infrastructure 8.0.4 Oracle Financial Services Analytical Applications Infrastructure 8.0.5 Oracle Financial Services Analytical Applications Infrastructure 8.0.6 Oracle Financial Services Analytical Applications Infrastructure 8.0.7 Oracle Banking Platform 2.6.0

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

1 Github repository

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook