Oracle Jd Edwards Enterpriseone Tools vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Oracle Jd Edwards Enterpriseone Tools: 144 record(s), with affected versions and fixes.cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools
CVE-2020-13956
Medium · 5.3
CWE-20 Dec 2, 2020
Improper Input Validation in Apache Software Foundation Httpclient
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVE-2020-11023
Medium · 6.1
KEV High · 67 Public exploit CWE-79 Apr 29, 2020
JQuery Cross-Site Scripting (XSS) Vulnerability
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2020-11620
High · 8.1
CWE-502 Apr 7, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
CVE-2020-11619
High · 8.1
CWE-502 Apr 7, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
CVE-2020-9548
Critical · 9.8
Public exploit CWE-502 Mar 2, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVE-2020-9547
Critical · 9.8
Public exploit CWE-502 Mar 2, 2020
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVE-2020-9546
Critical · 9.8
CWE-502 Mar 2, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
CVE-2019-20330
Critical · 9.8
CWE-502 Jan 3, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2019-17531
Critical · 9.8
CWE-502 Oct 12, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
CVE-2019-16943
Critical · 9.8
CWE-502 Oct 1, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
CVE-2019-16942
Critical · 9.8
CWE-502 Oct 1, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
CVE-2019-10086
High · 7.3
CWE-502 Aug 20, 2019
Deserialization of Untrusted Data in Apache Software Foundation Commons Beanutils
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVE-2019-14439
High · 7.5
CWE-502 Jul 30, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2019-14379
Critical · 9.8
CWE-1321 Jul 29, 2019
Prototype Pollution in Fasterxml Jackson-databind
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
CVE-2018-12023
High · 7.5
CWE-502 Mar 21, 2019
Deserialization of Untrusted Data
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
CVE-2018-12022
High · 7.5
CWE-502 Mar 21, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
CVE-2018-14718
Critical · 9.8
CWE-502 Jan 2, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVE-2017-15095
Critical · 9.8
CWE-502 Feb 6, 2018
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
CVE-2017-5645
Critical · 9.8
Public exploit CWE-502 Apr 17, 2017
Deserialization of Untrusted Data in Apache Software Foundation Log4j
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.