Vulnerabilidades do Oracle Goldengate Stream Analytics
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Oracle Goldengate Stream Analytics: 6 registro(s), com versões afetadas e correções.cpe:2.3:a:oracle:goldengate_stream_analytics
CVE-2019-14893
Crítica · 9.8
CWE-502 02/03/2020
Deserialization of Untrusted Data em Fasterxml Jackson-databind
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
CVE-2019-20330
Crítica · 9.8
CWE-502 03/01/2020
Deserialization of Untrusted Data em Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2019-16335
Crítica · 9.8
CWE-502 15/09/2019
Deserialization of Untrusted Data em Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
CVE-2019-14540
Crítica · 9.8
CWE-502 15/09/2019
Deserialization of Untrusted Data em Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-14439
Alta · 7.5
CWE-502 30/07/2019
Deserialization of Untrusted Data em Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2019-14379
Crítica · 9.8
CWE-1321 29/07/2019
Prototype Pollution em Fasterxml Jackson-databind
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.