Latest oracle communications unified inventory management vulnerabilities since last week (CVE List)

● CVE-2022-22965

Spring Framework JDK 9+ Remote Code Execution Vulnerability

VMware Spring Framework

VMware Spring Framework<5.2.20

VMware Spring Framework>=5.3.0<5.3.18

Cisco CX Cloud Agent<2.1.0

Oracle Communications Cloud Native Core Automated Test Suite=1.9.0

Oracle Communications Cloud Native Core Automated Test Suite=22.1.0

and 84 more

● CVE-2022-23632

Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security (TLS) configuration when the host header is a fully qualified domain name ...

Traefik Traefik<2.6.1

Oracle Communications Unified Inventory Management=7.5.0

● CVE-2022-23307

A deserialization flaw was found in Apache log4j 1.2.x. While reading serialized log events, they are improperly deserialized. Note this is the same as <a href="https://access.redhat.com/security/cve...

redhat/log4j<0:1.2.14-6.6.el6_10

redhat/log4j<0:1.2.17-18.el7_4

redhat/log4j<0:1.2.17-17.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 193 more

● CVE-2022-23305

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely...

redhat/log4j<0:1.2.14-6.6.el6_10

redhat/log4j<0:1.2.17-18.el7_4

redhat/log4j<0:1.2.17-17.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 196 more

● CVE-2022-23302

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service...

redhat/log4j<0:1.2.14-6.6.el6_10

redhat/log4j<0:1.2.17-18.el7_4

redhat/log4j<0:1.2.17-17.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 194 more

● CVE-2021-45105

Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el8

debian/apache-log4j2

debian/apache-log4j2<=2.16.0-1~deb10u1<=2.16.0-1<=2.16.0-1~deb11u1

and 217 more

● CVE-2021-4104

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

redhat/log4j<0:1.2.14-6.5.el6_10

redhat/log4j<0:1.2.17-17.el7_4

redhat/log4j<0:1.2.17-16.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 219 more

● CVE-2021-39147

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39149

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39144

XStream Remote Code Execution Vulnerability

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

XStream XStream

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

and 34 more

● CVE-2021-39151

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39152

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicl...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39140

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on ...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-39150

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicl...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39141

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-39153

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 27 more

● CVE-2021-39145

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-39154

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39146

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39148

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39139

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-36374

Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By persuading a victim to open a specially-crafted ZIP archive, a remote a...

maven/org.apache.ant:ant>=1.9.0<1.9.16

maven/org.apache.ant:ant>=1.10.0<1.10.11

Apache Ant>=1.9.0<1.9.16

Apache Ant>=1.10.0<1.10.11

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

and 75 more

● CVE-2021-36090

A flaw was found in apache-commons-compress. When reading a specially crafted ZIP archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This fla...

redhat/apache-commons-compress<0:1.21-1.2.el8e

IBM Cloud Pak System<=V2.3.0 - V2.3.3.3 Interim Fix 1

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.0<1.21

Oracle Banking Apis>=18.1<=18.3

Oracle Banking Apis=19.1

and 69 more

● CVE-2021-36373

Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By persuading a victim to open a specially-crafted TAR archive, a remote a...

redhat/Apache Ant<1.9.16

redhat/Ant<1.10.11

Apache Ant>=1.9.0<1.9.16

Apache Ant>=1.10.0<1.10.11

Oracle Agile PLM=9.3.6

Oracle Banking Trade Finance=14.5

and 69 more

● CVE-2021-22118

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a...

maven/org.springframework:spring-web>=5.3.0<=5.3.6

maven/org.springframework:spring-web>=5.2.0<=5.2.14

IBM DRM<=2.0.6

redhat/spring-framework<5.3.7

redhat/spring-framework<5.2.15

VMware Spring Framework>=5.2.0<5.2.15

and 48 more

● CVE-2021-29505

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the...

redhat/xstream<0:1.3.1-14.el7_9

debian/libxstream-java

redhat/xstream<1.4.17

Xstream Project Xstream<1.4.17

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 37 more

● CVE-2021-21344

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code fr...

redhat/xstream<0:1.3.1-13.el7_9

debian/libxstream-java

redhat/xstream<1.4.16

Xstream Project Xstream<1.4.16

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 32 more

● CVE-2021-21348

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maxi...

debian/libxstream-java

redhat/xstream<1.4.16

Xstream Project Xstream<1.4.16

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

and 30 more

● CVE-2021-21346

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code fr...

redhat/xstream<0:1.3.1-13.el7_9

debian/libxstream-java

redhat/xstream<1.4.16

Xstream Project Xstream<1.4.16

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-21347

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code fr...

redhat/xstream<0:1.3.1-13.el7_9

debian/libxstream-java

redhat/xstream<1.4.16

Xstream Project Xstream<1.4.16

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 34 more

● CVE-2021-21345

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute ...

redhat/xstream<0:1.3.1-13.el7_9

debian/libxstream-java

redhat/xstream<1.4.16

Xstream Project Xstream<1.4.16

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 32 more

● CVE-2021-21351

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a r...

debian/libxstream-java

redhat/xstream<1.4.16

Xstream Project Xstream<1.4.16

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

and 30 more

● CVE-2021-21343

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type informat...

debian/libxstream-java

redhat/xstream<1.4.16

Xstream Project Xstream<1.4.16

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

and 29 more

● CVE-2021-21342

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type informat...

Xstream Project Xstream<1.4.16

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 28 more

● CVE-2021-21349

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resourc...

debian/libxstream-java

redhat/xstream<1.4.16

Xstream Project Xstream<1.4.16

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

and 33 more

● CVE-2021-21341

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target...

debian/libxstream-java

redhat/xstream<1.4.16

Xstream Project Xstream<1.4.16

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

and 25 more

● CVE-2021-21350

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by man...

redhat/xstream<0:1.3.1-13.el7_9

debian/libxstream-java

redhat/xstream<1.4.16

Xstream Project Xstream<1.4.16

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 34 more

● CVE-2021-22112

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in...

Pivotal Software Spring Security<5.2.9

Pivotal Software Spring Security>=5.3.0<5.3.8

Vmware Spring Security>=5.4.0<5.4.4

Oracle Communications Element Manager>=8.2.0<=8.2.4.0

Oracle Communications Interactive Session Recorder=6.3

Oracle Communications Interactive Session Recorder=6.4

and 5 more

● CVE-2020-36180

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

Debian Debian Linux=9.0

and 72 more

● CVE-2020-36181

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

NetApp Service Level Manager

Debian Debian Linux=9.0

Oracle Agile PLM=9.3.6

and 71 more

● CVE-2020-36179

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

Debian Debian Linux=9.0

and 65 more

● CVE-2020-36183

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.00<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0.<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

and 72 more

● CVE-2020-36182

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

and 72 more

● CVE-2020-36184

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

Debian Debian Linux=9.0

Oracle Agile PLM=9.3.6

and 71 more

● CVE-2020-36185

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

and 71 more

● CVE-2020-35728

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka em...

IBM Disconnected Log Collector<=v1.0 - v1.8.2

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<=2.9.10.7

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.9.0<2.9.10.8

Debian Debian Linux=9.0

NetApp Service Level Manager

and 62 more

● CVE-2020-36188

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

IBM Disconnected Log Collector<=v1.0 - v1.8.2

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

and 73 more

● CVE-2020-36189

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

IBM Disconnected Log Collector<=v1.0 - v1.8.2

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

and 65 more

● CVE-2020-36186

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

and 71 more

● CVE-2020-36187

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

and 71 more

Latest oracle communications unified inventory management Vulnerabilities

Company

Resources

Contact