Latest oracle agile plm vulnerabilities since last week (CVE List)

● CVE-2023-22039

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: WebClient). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged a...

Oracle Agile PLM=9.3.6

● CVE-2022-25762

Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by improper error handling in WebSocket connection. By sending a specially-crafted WebSocket message concurrently wi...

Apache Tomcat>=8.5.0<8.5.76

Apache Tomcat>=9.0.0<9.0.21

Oracle Agile PLM=9.3.6

IBM IBM® Engineering Requirements Management DOORS<=9.7.2.7

IBM IBM® Engineering Requirements Management DOORS Web Access<=9.7.2.7

● CVE-2022-21467

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Attachments). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged a...

Oracle Agile PLM=9.3.6

● CVE-2022-23437

Apache Xerces2 Java XML Parser is vulnerable to a denial of service, caused by an infinite loop in the XML parser. By persuading a victim to open a specially-crafted XML document payloads, a remote at...

redhat/eap7-xerces-j2<0:2.12.0-3.SP04_redhat_00001.1.el8ea

redhat/eap7-xerces-j2<0:2.12.0-3.SP04_redhat_00001.1.el7ea

IBM Sterling Secure Proxy<=6.0.3

redhat/xerces-j2<2.12.2

Apache Xerces-j<=2.12.1

Oracle Agile Engineering Data Management=6.2.1.0

and 56 more

● CVE-2021-45105

Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el8

debian/apache-log4j2

debian/apache-log4j2<=2.16.0-1~deb10u1<=2.16.0-1<=2.16.0-1~deb11u1

and 217 more

● CVE-2021-41164

CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The...

Ckeditor Ckeditor>=4.0<4.17.0

Drupal Drupal>=8.9.0<8.9.20

Drupal Drupal>=9.1.0<9.1.14

Drupal Drupal>=9.2.0<9.2.9

Oracle Banking Apis>=18.1<=18.3

Oracle Banking Apis=19.1

and 19 more

● CVE-2021-41183

### Impact Accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: ```...

ubuntu/jqueryui<1.10.1+dfsg-1ubuntu0.14.04.1~

ubuntu/jqueryui<1.13.0

ubuntu/jqueryui<1.12.1+dfsg-5ubuntu0.18.04.1~

ubuntu/jqueryui<1.12.1+dfsg-5ubuntu0.20.04.1

ubuntu/jqueryui<1.10.1+dfsg-1ubuntu0.16.04.1~

rubygems/jquery-ui-rails<7.0.0

and 116 more

● CVE-2021-41184

### Impact Accepting the value of the `of` option of the [`.position()`](https://api.jqueryui.com/position/) util from untrusted sources may execute untrusted code. For example, invoking the following...

rubygems/jquery-ui-rails<7.0.0

nuget/jQuery.UI.Combined<1.13.0

maven/org.webjars.npm:jquery-ui<1.13.0

npm/jquery-ui<1.13.0

IBM QRadar SIEM<=7.5.0 GA

IBM QRadar SIEM<=7.4.3 GA - 7.4.3 FP4

and 75 more

● CVE-2021-41182

### Impact Accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: ```js...

rubygems/jquery-ui-rails<7.0.0

maven/org.webjars.npm:jquery-ui<1.13.0

nuget/jQuery.UI.Combined<1.13.0

npm/jquery-ui<1.13.0

IBM QRadar SIEM<=7.5.0 GA

IBM QRadar SIEM<=7.4.3 GA - 7.4.3 FP4

and 126 more

● CVE-2021-40690

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from ...

maven/org.apache.santuario:xmlsec<2.1.7

maven/org.apache.santuario:xmlsec>=2.2.0<2.2.3

Apache Santuario XML Security for Java<2.1.7

Apache Santuario XML Security for Java>=2.2.0<2.2.3

Apache CXF=3.4.4

Apache TomEE<8.0.8

and 70 more

● CVE-2021-2351

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unau...

Oracle Advanced Networking Option=12.1.0.2

Oracle Advanced Networking Option=12.2.0.1

Oracle Advanced Networking Option=19c

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

Oracle Agile Product Lifecycle Management for Process=6.2.2.0

and 242 more

● CVE-2021-36374

Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By persuading a victim to open a specially-crafted ZIP archive, a remote a...

maven/org.apache.ant:ant>=1.9.0<1.9.16

maven/org.apache.ant:ant>=1.10.0<1.10.11

Apache Ant>=1.9.0<1.9.16

Apache Ant>=1.10.0<1.10.11

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

and 75 more

● CVE-2021-36373

Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By persuading a victim to open a specially-crafted TAR archive, a remote a...

redhat/Apache Ant<1.9.16

redhat/Ant<1.10.11

Apache Ant>=1.9.0<1.9.16

Apache Ant>=1.10.0<1.10.11

Oracle Agile PLM=9.3.6

Oracle Banking Trade Finance=14.5

and 69 more

● CVE-2021-33037

Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially-crafted HTTP(S) transfer-encoding request header,...

redhat/jws5-tomcat<0:9.0.50-3.redhat_00004.1.el7

redhat/jws5-tomcat-native<0:1.2.30-3.redhat_3.el7

redhat/jws5-tomcat-vault<0:1.1.8-4.Final_redhat_00004.1.el7

redhat/jws5-tomcat<0:9.0.50-3.redhat_00004.1.el8

redhat/jws5-tomcat-native<0:1.2.30-3.redhat_3.el8

redhat/jws5-tomcat-vault<0:1.1.8-4.Final_redhat_00004.1.el8

and 91 more

● CVE-2021-3572

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest ...

redhat/python-pip<0:9.0.3-20.el8

redhat/rh-python38-babel<0:2.7.0-12.el7

redhat/rh-python38-python<0:3.8.11-2.el7

redhat/rh-python38-python-cryptography<0:2.8-5.el7

redhat/rh-python38-python-jinja2<0:2.10.3-6.el7

redhat/rh-python38-python-lxml<0:4.4.1-7.el7

and 12 more

● CVE-2021-29425

Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the FileNameUtils.normalize method. An attacker could send a specially-cra...

redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea

redhat/eap7-jberet<0:1.3.9-1.Final_redhat_00001.1.el6ea

and 185 more

● CVE-2021-25122

A flaw was found in Apache Tomcat. When responding to new h2c connection requests, Apache Tomcat could duplicate request headers and a limited amount of request body from one request to another meanin...

redhat/jws5-ecj<0:4.12.0-3.redhat_2.2.el7

redhat/jws5-tomcat<0:9.0.43-11.redhat_00011.1.el7

redhat/jws5-tomcat-native<0:1.2.26-3.redhat_3.el7

redhat/jws5-tomcat-vault<0:1.1.8-2.Final_redhat_00003.1.el7

redhat/jws5-ecj<0:4.12.0-3.redhat_2.2.el8

redhat/jws5-tomcat<0:9.0.43-11.redhat_00011.1.el8

and 65 more

● CVE-2021-25329

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely...

redhat/jws5-ecj<0:4.12.0-3.redhat_2.2.el7

redhat/jws5-tomcat<0:9.0.43-11.redhat_00011.1.el7

redhat/jws5-tomcat-native<0:1.2.26-3.redhat_3.el7

redhat/jws5-tomcat-vault<0:1.1.8-2.Final_redhat_00003.1.el7

redhat/jws5-ecj<0:4.12.0-3.redhat_2.2.el8

redhat/jws5-tomcat<0:9.0.43-11.redhat_00011.1.el8

and 69 more

● CVE-2021-26271

CKEditor is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the Advanced Tab for Dialogs plugin. By persuading a victim to paste specially-crafted t...

Ckeditor Ckeditor>=4.0<4.16

Oracle Agile PLM=9.3.5

Oracle Agile PLM=9.3.6

Oracle Application Express<21.1.0

Oracle Financial Services Analytical Applications Infrastructure>=8.0.6<=8.0.9

Oracle Financial Services Analytical Applications Infrastructure=8.1.0

and 19 more

● CVE-2021-24122

A flaw was found in Apache Tomcat. When serving resources from a network location using the NTFS file system, it was possible to bypass security constraints and view the source code for JSPs in some c...

redhat/jws5-tomcat<0:9.0.36-9.redhat_8.1.el7

redhat/jws5-tomcat-native<0:1.2.25-3.redhat_3.el7

redhat/jws5-tomcat<0:9.0.36-9.redhat_8.1.el8

redhat/jws5-tomcat-native<0:1.2.25-3.redhat_3.el8

Apache Tomcat>=7.0.0<=7.0.106

Apache Tomcat>=8.5.0<=8.5.59

and 47 more

● CVE-2020-36183

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.00<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0.<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

and 72 more

● CVE-2020-36180

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

Debian Debian Linux=9.0

and 72 more

● CVE-2020-36179

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

Debian Debian Linux=9.0

and 65 more

● CVE-2020-36181

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

NetApp Service Level Manager

Debian Debian Linux=9.0

Oracle Agile PLM=9.3.6

and 71 more

● CVE-2020-36182

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

and 72 more

● CVE-2020-36184

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

Debian Debian Linux=9.0

Oracle Agile PLM=9.3.6

and 71 more

● CVE-2020-36185

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

and 71 more

● CVE-2020-35728

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka em...

IBM Disconnected Log Collector<=v1.0 - v1.8.2

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<=2.9.10.7

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.9.0<2.9.10.8

Debian Debian Linux=9.0

NetApp Service Level Manager

and 62 more

● CVE-2020-36188

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

IBM Disconnected Log Collector<=v1.0 - v1.8.2

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

and 73 more

● CVE-2020-36189

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

IBM Disconnected Log Collector<=v1.0 - v1.8.2

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

and 65 more

● CVE-2020-36186

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

and 71 more

● CVE-2020-36187

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

and 71 more

● CVE-2020-35491

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

IBM Security Verify Governance<=10.0

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.9.10.8

NetApp Service Level Manager

Debian Debian Linux=9.0

Oracle Agile PLM=9.3.6

and 35 more

● CVE-2020-35490

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

IBM Security Verify Governance<=10.0

redhat/jackson-databind<2.9.10.8

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<=2.9.10.7

FasterXML jackson-databind>=2.0.0<2.9.10.8

NetApp Service Level Manager

Debian Debian Linux=9.0

and 35 more

● CVE-2020-17521

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method ca...

Apache Groovy>=2.0.0<=2.4.20

Apache Groovy>=2.5.0<=2.5.13

Apache Groovy>=3.0.0<=3.0.6

Apache Groovy=4.0.0-alpha1

Netapp Snapcenter

Oracle Agile Engineering Data Management=6.2.1.0

and 37 more

● CVE-2020-27193

A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML cod...

Ckeditor Ckeditor=4.15.0

Oracle Agile PLM=9.3.5

Oracle Agile PLM=9.3.6

Oracle Application Express<21.1.0.00.01

Oracle Banking Party Management=2.7.0

Oracle Banking Platform=2.4.0

and 19 more

● CVE-2020-24750

FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.Jn...

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.6

Oracle Agile PLM=9.3.6

Oracle Application Testing Suite=13.3.0.1

Oracle Autovue For Agile Product Lifecycle Management=21.0.2

Oracle Banking Corporate Lending Process Management=14.2.0

and 36 more

● CVE-2020-24616

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<=2.9.10.5

IBM ISAM<=9.0.7

IBM Security Verify Access<=10.0.0

FasterXML jackson-databind>=2.0.0<2.9.10.6

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vmware Vsphere

and 30 more

● CVE-2020-13935

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could tr...

redhat/tomcat<0:7.0.76-15.el7

redhat/jbossweb<0:7.5.31-2.Final_redhat_2.1.ep6.el5

redhat/jbossweb<0:7.5.31-2.Final_redhat_2.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

redhat/jbossas-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

redhat/jbossas-bundles<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 220 more

● CVE-2020-13934

A flaw was found in Apache Tomcat, where an h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests are made, an OutOfMemoryEx...

redhat/jws5-tomcat<0:9.0.30-5.redhat_6.1.el6

redhat/jws5-tomcat<0:9.0.30-5.redhat_6.1.el7

redhat/jws5-tomcat<0:9.0.30-5.redhat_6.1.el8

redhat/tomcat<10.0.0

redhat/tomcat<9.0.37

redhat/tomcat<8.5.57

and 58 more

● CVE-2020-14195

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing. The highest threat from this vul...

redhat/candlepin<0:2.6.16-1.el7

redhat/foreman<0:1.22.0.39-2.el7

redhat/satellite<0:6.6.3-1.el7

redhat/tfm-rubygem-fog-ovirt<0:1.2.3-1.el7

redhat/tfm-rubygem-katello<0:3.12.0.41-1.el7

redhat/tfm-rubygem-runcible<0:2.13.0-1.el7

and 311 more

● CVE-2020-9484

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; a...

redhat/tomcat6<0:6.0.24-115.el6_10

redhat/tomcat<0:7.0.76-12.el7_8

redhat/tomcat7<0:7.0.70-40.ep7.el6

redhat/tomcat8<0:8.0.36-44.ep7.el6

redhat/tomcat-native<0:1.2.23-22.redhat_22.ep7.el6

redhat/tomcat7<0:7.0.70-40.ep7.el7

and 99 more

● CVE-2020-14060

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data co...

redhat/candlepin<0:2.6.16-1.el7

redhat/foreman<0:1.22.0.39-2.el7

redhat/satellite<0:6.6.3-1.el7

redhat/tfm-rubygem-fog-ovirt<0:1.2.3-1.el7

redhat/tfm-rubygem-katello<0:3.12.0.41-1.el7

redhat/tfm-rubygem-runcible<0:2.13.0-1.el7

and 30 more

● CVE-2020-14062

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this...

redhat/candlepin<0:2.6.16-1.el7

redhat/foreman<0:1.22.0.39-2.el7

redhat/satellite<0:6.6.3-1.el7

redhat/tfm-rubygem-fog-ovirt<0:1.2.3-1.el7

redhat/tfm-rubygem-katello<0:3.12.0.41-1.el7

redhat/tfm-rubygem-runcible<0:2.13.0-1.el7

and 309 more

● CVE-2020-14061

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this...

redhat/candlepin<0:2.6.16-1.el7

redhat/foreman<0:1.22.0.39-2.el7

redhat/satellite<0:6.6.3-1.el7

redhat/tfm-rubygem-fog-ovirt<0:1.2.3-1.el7

redhat/tfm-rubygem-katello<0:3.12.0.41-1.el7

redhat/tfm-rubygem-runcible<0:2.13.0-1.el7

and 311 more

● CVE-2020-11619

A flaw was found in jackson-databind 2.x. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as...

redhat/candlepin<0:2.6.16-1.el7

redhat/foreman<0:1.22.0.39-2.el7

redhat/satellite<0:6.6.3-1.el7

redhat/tfm-rubygem-fog-ovirt<0:1.2.3-1.el7

redhat/tfm-rubygem-katello<0:3.12.0.41-1.el7

redhat/tfm-rubygem-runcible<0:2.13.0-1.el7

and 325 more

● CVE-2020-11113

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data co...

redhat/qpid-cpp<0:1.36.0-31.el6_10a

redhat/qpid-proton<0:0.32.0-1.el6_10

redhat/qpid-cpp<0:1.36.0-31.el7a

redhat/qpid-proton<0:0.32.0-2.el7

redhat/nodejs-rhea<0:1.0.24-1.el8

redhat/qpid-proton<0:0.32.0-2.el8

and 59 more

● CVE-2020-11112

FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization in org.apache.commons.proxy.provider.remoting.RmiProvider (aka apa...

redhat/Jackson-databind<2.9.10.4

redhat/rh-maven35-jackson-databind<0:2.7.6-2.9.el7

IBM Data Risk Manager<=2.0.6

FasterXML jackson-databind>=2.9.0<2.9.10.4

Debian Debian Linux=8.0

Netapp Steelstore Cloud Integrated Storage

and 51 more

● CVE-2020-11111

FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization in org.apache.activemq.* (aka activemq-jms, activemq-core, activem...

redhat/Jackson-databind<2.9.10.4

redhat/rh-maven35-jackson-databind<0:2.7.6-2.9.el7

IBM Data Risk Manager<=2.0.6

FasterXML jackson-databind>=2.9.0<2.9.10.4

Debian Debian Linux=8.0

Netapp Steelstore Cloud Integrated Storage

and 39 more

● CVE-2020-10968

A flaw was found in jackson-databind 2.x prior to version 2.9.10.4. The interaction between serialization gadgets and typing is mishandled in the bus-proxy. The highest threat from this vulnerability...

redhat/candlepin<0:2.6.16-1.el7

redhat/foreman<0:1.22.0.39-2.el7

redhat/satellite<0:6.6.3-1.el7

redhat/tfm-rubygem-fog-ovirt<0:1.2.3-1.el7

redhat/tfm-rubygem-katello<0:3.12.0.41-1.el7

redhat/tfm-rubygem-runcible<0:2.13.0-1.el7

and 345 more

Latest oracle agile plm Vulnerabilities

Company

Resources

Contact