CVE-2022-23307
Published Jan 18, 2022CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue ex…
Vendor/product archive
oracle / communications_offline_mediation_controller CVEs
Beta · best-effort34 CVEs tagged to oracle / communications_offline_mediation_controller — 2 Critical, 27 High, 4 Medium, 1 Low, 0 Unrated.
CVE-2022-23305
Published Jan 18, 2022By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message con…
- evidence mentions
- 1
- Buzz score
- 11.9
CVE-2022-23302
Published Jan 18, 2022JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration refer…
- evidence mentions
- 1
- Buzz score
- 11.9
CVE-2021-44832
Published Dec 28, 2021Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses…
- evidence mentions
- 11
- Buzz score
- 40.9
CVE-2021-28041
Published Mar 5, 2021ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or t…
CVE-2020-11987
Published Feb 24, 2021Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker coul…
CVE-2021-23336
Published Feb 15, 2021The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning v…
CVE-2021-3177
Published Jan 19, 2021Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-po…
CVE-2020-36183
Published Jan 7, 2021FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPo…
CVE-2020-36182
Published Jan 7, 2021FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapt…
CVE-2020-36180
Published Jan 7, 2021FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCP…
CVE-2020-36179
Published Jan 7, 2021FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapt…
CVE-2020-36189
Published Jan 6, 2021FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.Drive…
CVE-2020-36188
Published Jan 6, 2021FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIC…
CVE-2020-36187
Published Jan 6, 2021FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDa…
CVE-2020-36186
Published Jan 6, 2021FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolD…
CVE-2020-36185
Published Jan 6, 2021FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolD…
CVE-2020-36184
Published Jan 6, 2021FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPool…
CVE-2020-36181
Published Jan 6, 2021FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapte…
CVE-2020-35491
Published Dec 17, 2020FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataS…
CVE-2020-35490
Published Dec 17, 2020FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolData…
CVE-2020-27783
Published Dec 3, 2020A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and…
CVE-2020-25649
Published Dec 3, 2020A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The h…
- evidence mentions
- 2
- Buzz score
- 17.5
CVE-2020-27218
Published Nov 28, 2020In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests fr…
CVE-2019-17566
Published Nov 12, 2020Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker c…
Showing 1-25 of 34 CVEsPage 1 of 2