Oracle Fusion Middleware Mapviewer vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Oracle Fusion Middleware Mapviewer: 4 record(s), with affected versions and fixes.
cpe:2.3:a:oracle:fusion_middleware_mapviewer

CVE-2021-29425 Medium · 4.8 CWE-22 Apr 13, 2021

Possible limited path traversal vulnerabily in Apache Commons IO

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

CVE-2020-11987 High · 8.2 CWE-20 Feb 24, 2021

Improper Input Validation in Apache Software Foundation Batik

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

CVE-2019-10219 Medium · 6.1 CWE-79 Nov 8, 2019

Cross-site Scripting (XSS) in Red Hat Hibernate Validator

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

CVE-2017-5645 Critical · 9.8 Public exploit CWE-502 Apr 17, 2017

Deserialization of Untrusted Data in Apache Software Foundation Log4j

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.