oracle retail xstore point of service 17.0 vulnerabilities and exploits

(subscribe to this query)

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can t...

Eclipse Jetty Oracle Retail Xstore Point Of Service 15.0 Oracle Retail Xstore Point Of Service 16.0.0 Oracle Retail Xstore Point Of Service 7.1 Oracle Retail Xstore Point Of Service 17.0

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

Mchange C3p0 Fedoraproject Fedora 29 Fedoraproject Fedora 30 Oracle Retail Xstore Point Of Service 15.0 Oracle Flexcube Private Banking 12.1.0 Oracle Flexcube Private Banking 12.0.0 Oracle Webcenter Sites 12.2.1.3.0 Oracle Retail Xstore Point Of Service 16.0 Oracle Webcenter Sites 12.2.1.4.0 Oracle Retail Xstore Point Of Service 17.0 Oracle Retail Xstore Point Of Service 18.0 Oracle Retail Xstore Point Of Service 19.0 Oracle Communications Ip Service Activator 7.4.0 Oracle Communications Ip Service Activator 7.3.0 Oracle Hyperion Infrastructure Technology 11.1.2.4 Oracle Enterprise Manager Ops Center 12.4.0.0 Oracle Communications Session Route Manager Oracle Enterprise Manager Base Platform 13.2.1.0 Oracle Documaker

Jetty up to and including 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote malicious users to obtain access by observing elapsed times before rejection of incorrect passwords.

Eclipse Jetty Debian Debian Linux 9.0 Oracle Retail Xstore Point Of Service 15.0 Oracle Retail Xstore Point Of Service 7.1 Oracle Hospitality Guest Access 4.2.0 Oracle Hospitality Guest Access 4.2.1 Oracle Retail Xstore Point Of Service 16.0 Oracle Enterprise Manager Base Platform 13.3 Oracle Enterprise Manager Base Platform 13.2 Oracle Retail Xstore Point Of Service 17.0 Oracle Rest Data Services 12.2.0.1 Oracle Rest Data Services 12.1.0.2 Oracle Rest Data Services 11.2.0.4 Oracle Rest Data Services 18c Oracle Communications Cloud Native Core Policy 1.5.0

In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.

Apache Pdfbox 2.0 Apache Pdfbox Apache Pdfbox 2.0.0 Fedoraproject Fedora 29 Fedoraproject Fedora 30 Oracle Retail Xstore Point Of Service 17.0

A Polymorphic Typing issue exists in FasterXML jackson-databind prior to 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

1 Github repository

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the ...

1 Article

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

1 Github repository

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size coul...

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Fasterxml Jackson-databind Netapp Active Iq Unified Manager Debian Debian Linux 8.0 Oracle Retail Xstore Point Of Service 15.0 Oracle Primavera Unifier 16.2 Oracle Primavera Unifier 16.1 Oracle Weblogic Server 12.2.1.3.0 Oracle Retail Xstore Point Of Service 16.0 Oracle Primavera Unifier 18.8 Oracle Primavera Unifier Oracle Weblogic Server 12.2.1.4.0 Oracle Enterprise Manager Base Platform 13.3.0.0 Oracle Primavera Unifier 19.12 Oracle Enterprise Manager Base Platform 13.4.0.0 Oracle Communications Instant Messaging Server 10.0.1.4.0 Oracle Retail Xstore Point Of Service 17.0 Oracle Retail Xstore Point Of Service 18.0 Oracle Retail Xstore Point Of Service 19.0 Oracle Communications Evolved Communications Application Server 7.1 Oracle Communications Network Charging And Control 6.0.1 Oracle Jd Edwards Enterpriseone Tools Oracle Jd Edwards Enterpriseone Orchestrator

2 Github repositories

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook