Latest oracle jdeveloper Vulnerabilities

● CVE-2022-21445

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability ...

Oracle JDeveloper=12.2.1.3.0

Oracle JDeveloper=12.2.1.4.0

● CVE-2022-23307

A deserialization flaw was found in Apache log4j 1.2.x. While reading serialized log events, they are improperly deserialized. Note this is the same as <a href="https://access.redhat.com/security/cve...

redhat/log4j<0:1.2.14-6.6.el6_10

redhat/log4j<0:1.2.17-18.el7_4

redhat/log4j<0:1.2.17-17.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 193 more

● CVE-2022-23305

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely...

redhat/log4j<0:1.2.14-6.6.el6_10

redhat/log4j<0:1.2.17-18.el7_4

redhat/log4j<0:1.2.17-17.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 196 more

● CVE-2022-23302

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service...

redhat/log4j<0:1.2.14-6.6.el6_10

redhat/log4j<0:1.2.17-18.el7_4

redhat/log4j<0:1.2.17-17.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 194 more

● CVE-2021-45105

Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el8

debian/apache-log4j2

debian/apache-log4j2<=2.16.0-1~deb10u1<=2.16.0-1<=2.16.0-1~deb11u1

and 217 more

● CVE-2021-4104

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

redhat/log4j<0:1.2.14-6.5.el6_10

redhat/log4j<0:1.2.17-17.el7_4

redhat/log4j<0:1.2.17-16.el7_3

redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6

redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6

redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6

and 219 more

● CVE-2020-11022

### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patch...

rubygems/jquery-rails<4.4.0

maven/org.webjars.npm:jquery>=1.2.0<3.5.0

nuget/jquery>=1.2.0<3.5.0

npm/jquery>=1.2.0<3.5.0

redhat/qpid-dispatch<0:1.13.0-3.el6_10

redhat/qpid-dispatch<0:1.13.0-3.el7

and 164 more

● CVE-2019-12415

Apache POI could allow a remote attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data by tool XSSFExportToXml. By sending a specially-crafted ...

redhat/poi<4.1.0

IBM Cloud Pak for Business Automation<=V22.0.2

IBM Cloud Pak for Business Automation<=V21.0.3 - V21.0.3-IF016

IBM Cloud Pak for Business Automation<=V22.0.1 - V22.0.1-IF006 and later fixes V21.0.2 - V21.0.2-IF012 and later fixesV21.0.1 - V21.0.1-IF007 and later fixesV20.0.1 - V20.0.3 and later fixesV19.0.1 - V19.0.3 and later fixesV18.0.0 - V18.0.2 and later fixes

Apache POI<=4.1.0

Oracle Application Testing Suite=12.5.0.3

and 63 more

● CVE-2019-2899

Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: OAM). Supported versions that are affected are 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0 and 12.2.1.3.0. Easily ...

Oracle Application Development Framework=11.1.1.9.0

Oracle Application Development Framework=11.1.2.4.0

Oracle Application Development Framework=12.1.3.0.0

Oracle Application Development Framework=12.2.1.3.0

Oracle JDeveloper=11.1.1.9.0

Oracle JDeveloper=11.1.2.4.0

and 4 more

● CVE-2019-12402

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service at...

maven/io.github.1tchy.java9modular.org.apache.commons:commons-compress=1.18.1

maven/org.apache.commons:commons-compress>=1.15<1.19

redhat/apache-commons-compress<1.19

Apache Commons Compress>=1.15<=1.18

Fedoraproject Fedora=30

Fedoraproject Fedora=31

and 35 more

● CVE-2020-10683

dom4j could allow a remote authenticated attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data. By sending specially crafted XML data, a remot...

redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea

redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea

redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el6ea

and 204 more

● CVE-2019-11358

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted J...

redhat/ansible-tower<0:3.5.2-1.el7a

redhat/cfme<0:5.10.9.1-1.el7cf

redhat/cfme-amazon-smartstate<0:5.10.9.1-1.el7cf

redhat/cfme-appliance<0:5.10.9.1-1.el7cf

redhat/cfme-gemset<0:5.10.9.1-1.el7cf

redhat/ovirt-ansible-hosted-engine-setup<0:1.0.23-1.el7e

and 267 more

● CVE-2018-14721

FasterXML jackson-databind is vulnerable to server-side request forgery, caused by the failure to block the axis2-jaxws class from polymorphic deserialization. A remote authenticated attacker could ex...

FasterXML jackson-databind>=2.6.0<2.6.7.2

FasterXML jackson-databind>=2.7.0<2.7.9.5

FasterXML jackson-databind>=2.8.0<2.8.11.3

FasterXML jackson-databind>=2.9.0<2.9.7

FasterXML jackson-databind=2.7.0-rc1

FasterXML jackson-databind=2.7.0-rc2

and 40 more

● CVE-2018-14718

FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic d...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.3

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<=2.7.9.4

maven/com.fasterxml.jackson.core:jackson-databind>=2.8.0<=2.8.11.2

maven/com.fasterxml.jackson.core:jackson-databind>=2.9.0<2.9.7

IBM GDE<=3.0.0.2

FasterXML jackson-databind>=2.0.0<2.6.7.3

and 58 more

● CVE-2018-14720

FasterXML jackson-databind could allow a remote attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data by JDK classes. By sending a specially-c...

redhat/jackson-databind<2.9.7

redhat/jackson-databind<2.7.9.5

redhat/jackson-databind<2.8.11.3

debian/jackson-databind

FasterXML jackson-databind>=2.6.0<2.6.7.2

FasterXML jackson-databind>=2.7.0<2.7.9.5

and 40 more

● CVE-2018-14719

FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<=2.7.9.4

maven/com.fasterxml.jackson.core:jackson-databind>=2.8.0<=2.8.11.2

maven/com.fasterxml.jackson.core:jackson-databind>=2.9.0<2.9.7

redhat/jackson-databind<2.9.7

redhat/jackson-databind<2.7.9.5

redhat/jackson-databind<2.8.11.3

and 57 more

Latest oracle jdeveloper Vulnerabilities

Company

Resources

Contact