Red Hat Decision Manager vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Red Hat Decision Manager: 7 record(s), with affected versions and fixes.cpe:2.3:a:redhat:decision_manager
CVE-2023-44487
High · 7.5
KEV Urgent · 73 Public exploit CWE-400 Oct 10, 2023
HTTP/2 Rapid Reset Attack Vulnerability
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2019-14892
Critical · 9.8
CWE-502 Mar 2, 2020
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
CVE-2018-12023
High · 7.5
CWE-502 Mar 21, 2019
Deserialization of Untrusted Data
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
CVE-2018-12022
High · 7.5
CWE-502 Mar 21, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
CVE-2018-19362
Critical · 9.8
CWE-502 Jan 2, 2019
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CVE-2018-19361
Critical · 9.8
CWE-502 Jan 2, 2019
Deserialization of Untrusted Data in jackson-databind
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVE-2018-19360
Critical · 9.8
CWE-502 Jan 2, 2019
Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.