Vulnerabilidades do Oracle Jd Edwards Enterpriseone Orchestrator

CVE-2020-36183 Alta · 8.1 CWE-502 06/01/2021

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

CVE-2020-36189 Alta · 8.1 CWE-502 06/01/2021

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

CVE-2020-36188 Alta · 8.1 CWE-502 06/01/2021

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

CVE-2020-36187 Alta · 8.1 CWE-502 06/01/2021

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

CVE-2020-36186 Alta · 8.1 CWE-502 06/01/2021

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

CVE-2020-36185 Alta · 8.1 CWE-502 06/01/2021

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

CVE-2020-17521 Média · 5.5 07/12/2020

Apache Groovy provides extension methods to aid with creating temporary directories…

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

CVE-2020-25649 Alta · 7.5 CWE-611 03/12/2020

XML External Entity (XXE) em Fasterxml Jackson-databind

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

CVE-2020-13956 Média · 5.3 CWE-20 02/12/2020

Improper Input Validation em Apache Software Foundation Httpclient

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

CVE-2020-11023 Média · 6.1 KEV Alta · 61 Exploit público CWE-79 29/04/2020

JQuery Cross-Site Scripting (XSS) Vulnerability

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2020-11620 Alta · 8.1 CWE-502 07/04/2020

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

CVE-2020-11619 Alta · 8.1 CWE-502 07/04/2020

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

CVE-2020-9548 Crítica · 9.8 Exploit público CWE-502 02/03/2020

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

CVE-2020-9547 Crítica · 9.8 Exploit público CWE-502 02/03/2020

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

CVE-2020-9546 Crítica · 9.8 CWE-502 02/03/2020

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

CVE-2019-20330 Crítica · 9.8 CWE-502 03/01/2020

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

CVE-2019-10219 Média · 6.1 CWE-79 08/11/2019

Cross-site Scripting (XSS) em Red Hat Hibernate Validator

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

CVE-2019-17531 Crítica · 9.8 CWE-502 12/10/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

CVE-2019-16943 Crítica · 9.8 CWE-502 01/10/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

CVE-2019-16942 Crítica · 9.8 CWE-502 01/10/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

CVE-2019-10086 Alta · 7.3 CWE-502 20/08/2019

Deserialization of Untrusted Data em Apache Software Foundation Commons Beanutils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CVE-2019-14439 Alta · 7.5 CWE-502 30/07/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

CVE-2019-14379 Crítica · 9.8 CWE-1321 29/07/2019

Prototype Pollution em Fasterxml Jackson-databind

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

CVE-2018-14718 Crítica · 9.8 CWE-502 02/01/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.