Oracle Siebel Engineering - Installer & Deployment vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Oracle Siebel Engineering - Installer & Deployment: 8 record(s), with affected versions and fixes.cpe:2.3:a:oracle:siebel_engineering_-_installer_&_deployment
CVE-2020-5398
High · 7.5
CWE-494 Jan 16, 2020
RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
CVE-2019-20330
Critical · 9.8
CWE-502 Jan 3, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2019-17531
Critical · 9.8
CWE-502 Oct 12, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
CVE-2019-16943
Critical · 9.8
CWE-502 Oct 1, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
CVE-2019-16942
Critical · 9.8
CWE-502 Oct 1, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
CVE-2019-14439
High · 7.5
CWE-502 Jul 30, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2019-14379
Critical · 9.8
CWE-1321 Jul 29, 2019
Prototype Pollution in Fasterxml Jackson-databind
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
CVE-2018-14718
Critical · 9.8
CWE-502 Jan 2, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.