Vulnerabilidades do Red Hat Decision Manager
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Red Hat Decision Manager: 7 registro(s), com versões afetadas e correções.cpe:2.3:a:redhat:decision_manager
CVE-2023-44487
Alta · 7.5
KEV Urgente · 73 Exploit público CWE-400 10/10/2023
HTTP/2 Rapid Reset Attack Vulnerability
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2019-14892
Crítica · 9.8
CWE-502 02/03/2020
Deserialization of Untrusted Data em Fasterxml Jackson-databind
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
CVE-2018-12023
Alta · 7.5
CWE-502 21/03/2019
Deserialization of Untrusted Data
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
CVE-2018-12022
Alta · 7.5
CWE-502 21/03/2019
Deserialization of Untrusted Data em Fasterxml Jackson-databind
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
CVE-2018-19362
Crítica · 9.8
CWE-502 02/01/2019
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CVE-2018-19361
Crítica · 9.8
CWE-502 02/01/2019
Deserialization of Untrusted Data in jackson-databind
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVE-2018-19360
Crítica · 9.8
CWE-502 02/01/2019
Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.