Vulnerabilidades do Oracle WebCenter Portal
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Oracle WebCenter Portal: 61 registro(s), com versões afetadas e correções.
CVE-2020-25649
Alta · 7.5
CWE-611 03/12/2020
XML External Entity (XXE) em Fasterxml Jackson-databind
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
CVE-2020-2555
Crítica · 9.8
KEV Urgente · 83 Exploit público CWE-502 15/01/2020
Oracle Multiple Products Remote Code Execution Vulnerability
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2019-20330
Crítica · 9.8
CWE-502 03/01/2020
Deserialization of Untrusted Data em Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2019-10219
Média · 6.1
CWE-79 08/11/2019
Cross-site Scripting (XSS) em Red Hat Hibernate Validator
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
CVE-2019-17531
Crítica · 9.8
CWE-502 12/10/2019
Deserialization of Untrusted Data em Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
CVE-2019-16943
Crítica · 9.8
CWE-502 01/10/2019
Deserialization of Untrusted Data em Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
CVE-2019-16942
Crítica · 9.8
CWE-502 01/10/2019
Deserialization of Untrusted Data em Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
CVE-2018-14719
Crítica · 9.8
CWE-502 02/01/2019
Deserialization of Untrusted Data em Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
CVE-2018-14718
Crítica · 9.8
CWE-502 02/01/2019
Deserialization of Untrusted Data em Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVE-2017-7525
Crítica · 9.8
CWE-184 06/02/2018
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1…
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
CVE-2017-15095
Crítica · 9.8
CWE-502 06/02/2018
Deserialization of Untrusted Data em Fasterxml Jackson-databind
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.