Oracle Communications Network Charging And Control vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Oracle Communications Network Charging And Control: 24 record(s), with affected versions and fixes.cpe:2.3:a:oracle:communications_network_charging_and_control
CVE-2021-20227
Medium · 5.5
CWE-416 Mar 23, 2021
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an...
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
CVE-2020-36183
High · 8.1
CWE-502 Jan 6, 2021
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.
CVE-2020-36189
High · 8.1
CWE-502 Jan 6, 2021
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
CVE-2020-36188
High · 8.1
CWE-502 Jan 6, 2021
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
CVE-2020-36187
High · 8.1
CWE-502 Jan 6, 2021
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
CVE-2020-36186
High · 8.1
CWE-502 Jan 6, 2021
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.
CVE-2020-36185
High · 8.1
CWE-502 Jan 6, 2021
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.
CVE-2020-25649
High · 7.5
CWE-611 Dec 3, 2020
XML External Entity (XXE) in Fasterxml Jackson-databind
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
CVE-2020-15358
Medium · 5.5
CWE-787 Jun 27, 2020
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a...
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
CVE-2020-13871
High · 7.5
CWE-416 Jun 6, 2020
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite...
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-13632
Medium · 5.5
CWE-476 May 27, 2020
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted...
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
CVE-2020-13631
Medium · 5.5
May 27, 2020
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables...
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.
CVE-2020-13630
High · 7.0
CWE-416 May 27, 2020
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the...
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
CVE-2020-13434
Medium · 5.5
CWE-190 May 24, 2020
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
CVE-2020-11656
Critical · 9.8
CWE-416 Apr 9, 2020
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by...
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
CVE-2020-11655
High · 7.5
CWE-665 Apr 9, 2020
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a...
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.
CVE-2020-11620
High · 8.1
CWE-502 Apr 7, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
CVE-2020-11619
High · 8.1
CWE-502 Apr 7, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
CVE-2020-9548
Critical · 9.8
Public exploit CWE-502 Mar 2, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVE-2020-9547
Critical · 9.8
Public exploit CWE-502 Mar 2, 2020
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVE-2020-9546
Critical · 9.8
CWE-502 Mar 2, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
CVE-2020-9327
High · 7.5
CWE-476 Feb 21, 2020
In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference...
In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.
CVE-2019-20330
Critical · 9.8
CWE-502 Jan 3, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2019-10219
Medium · 6.1
CWE-79 Nov 8, 2019
Cross-site Scripting (XSS) in Red Hat Hibernate Validator
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.