Latest oracle primavera unifier vulnerabilities since last week (CVE List)

● CVE-2022-25169

Apache Tika<1.28.2

Apache Tika>=2.0.0<2.4.0

Oracle Primavera Unifier>=17.7<=17.12

Oracle Primavera Unifier=18.8

Oracle Primavera Unifier=19.12

Oracle Primavera Unifier=20.12

and 1 more

● CVE-2022-30126

In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. Thi...

Apache Tika<1.28.3

Apache Tika>=2.0.0<2.4.0

Oracle Primavera Unifier>=17.7<=17.12

Oracle Primavera Unifier=18.8

Oracle Primavera Unifier=19.12

Oracle Primavera Unifier=20.12

and 3 more

● CVE-2021-44832

Apache Log4j could allow a remote attacker with permission to modify the logging configuration file to execute arbitrary code on the system. By constructing a malicious configuration using a JDBC Appe...

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

Apache Log4j=2.0-beta9

Apache Log4j=2.15.0

Apache Log4j=2.17.0

Apache Log4j=1.2.x

and 58 more

● CVE-2021-45105

Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el8

debian/apache-log4j2

debian/apache-log4j2<=2.16.0-1~deb10u1<=2.16.0-1<=2.16.0-1~deb11u1

and 217 more

● CVE-2021-23450

Dojo could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution in the setObject function. By sending a specially-crafted request, an attacker could exploit...

Linuxfoundation Dojo<1.17.0

Oracle Communications Policy Management=12.6.0.0.0

Oracle Primavera Unifier>=17.7<=17.12

Oracle Primavera Unifier=18.8

Oracle Primavera Unifier=19.12

Oracle Primavera Unifier=20.12

and 4 more

● CVE-2021-41184

### Impact Accepting the value of the `of` option of the [`.position()`](https://api.jqueryui.com/position/) util from untrusted sources may execute untrusted code. For example, invoking the following...

rubygems/jquery-ui-rails<7.0.0

nuget/jQuery.UI.Combined<1.13.0

maven/org.webjars.npm:jquery-ui<1.13.0

npm/jquery-ui<1.13.0

IBM QRadar SIEM<=7.5.0 GA

IBM QRadar SIEM<=7.4.3 GA - 7.4.3 FP4

and 75 more

● CVE-2021-41182

### Impact Accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: ```js...

rubygems/jquery-ui-rails<7.0.0

maven/org.webjars.npm:jquery-ui<1.13.0

nuget/jQuery.UI.Combined<1.13.0

npm/jquery-ui<1.13.0

IBM QRadar SIEM<=7.5.0 GA

IBM QRadar SIEM<=7.4.3 GA - 7.4.3 FP4

and 126 more

● CVE-2021-42575

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

OWASP Java HTML Sanitizer<20211018.2

Oracle Middleware Common Libraries And Tools=12.2.1.3.0

Oracle Middleware Common Libraries And Tools=12.2.1.4.0

Oracle Primavera Unifier>=17.7<=17.12

Oracle Primavera Unifier=18.8

Oracle Primavera Unifier=19.12

and 2 more

● CVE-2021-38153

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful...

maven/org.apache.kafka:kafka-clients=2.8.0

maven/org.apache.kafka:kafka-clients>=2.7.0<2.7.2

maven/org.apache.kafka:kafka-clients>=2.0.0<2.6.3

maven/org.apache.kafka:kafka_2.13=2.8.0

maven/org.apache.kafka:kafka_2.13>=2.7.0<2.7.2

maven/org.apache.kafka:kafka_2.13>=2.4.0<2.6.3

and 26 more

● CVE-2021-37714

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, ...

redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea

redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea

redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea

redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea

and 55 more

● CVE-2021-2351

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unau...

Oracle Advanced Networking Option=12.1.0.2

Oracle Advanced Networking Option=12.2.0.1

Oracle Advanced Networking Option=19c

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

Oracle Agile Product Lifecycle Management for Process=6.2.2.0

and 242 more

● CVE-2021-36374

Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By persuading a victim to open a specially-crafted ZIP archive, a remote a...

maven/org.apache.ant:ant>=1.9.0<1.9.16

maven/org.apache.ant:ant>=1.10.0<1.10.11

Apache Ant>=1.9.0<1.9.16

Apache Ant>=1.10.0<1.10.11

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

and 75 more

● CVE-2021-35516

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for very small inputs. This...

redhat/apache-commons-compress<0:1.21-1.2.el8e

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.6<=1.20

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vmware Vsphere

Netapp Active Iq Unified Manager Windows

and 43 more

● CVE-2021-35517

A flaw was found in apache-commons-compress. When reading a specially crafted TAR archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This fla...

redhat/apache-commons-compress<0:1.21-1.2.el8e

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.1<=1.20

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vmware Vsphere

Netapp Active Iq Unified Manager Windows

and 50 more

● CVE-2021-36373

Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By persuading a victim to open a specially-crafted TAR archive, a remote a...

redhat/Apache Ant<1.9.16

redhat/Ant<1.10.11

Apache Ant>=1.9.0<1.9.16

Apache Ant>=1.10.0<1.10.11

Oracle Agile PLM=9.3.6

Oracle Banking Trade Finance=14.5

and 69 more

● CVE-2021-36090

A flaw was found in apache-commons-compress. When reading a specially crafted ZIP archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This fla...

redhat/apache-commons-compress<0:1.21-1.2.el8e

IBM Cloud Pak System<=V2.3.0 - V2.3.3.3 Interim Fix 1

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.0<1.21

Oracle Banking Apis>=18.1<=18.3

Oracle Banking Apis=19.1

and 69 more

● CVE-2021-35515

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This flaw allo...

redhat/apache-commons-compress<0:1.21-1.2.el8e

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.6<=1.20

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vmware Vsphere

Netapp Active Iq Unified Manager Windows

and 43 more

● CVE-2021-31811

Apache PDFBox is vulnerable to a denial of service, caused by an out-of-memory exception while loading a file. By persuading a victim to open a specially-crafted PDF file, a remote attacker could expl...

Apache PDFBox>=2.0.0<=2.0.23

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Oracle Banking Corporate Lending Process Management=14.2.0

Oracle Banking Corporate Lending Process Management=14.3.0

Oracle Banking Corporate Lending Process Management=14.5.0

and 17 more

● CVE-2021-29425

Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the FileNameUtils.normalize method. An attacker could send a specially-cra...

redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea

redhat/eap7-jberet<0:1.3.9-1.Final_redhat_00001.1.el6ea

and 185 more

● CVE-2021-28657

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

Apache Tika<=1.25

Oracle Healthcare Foundation=7.3.0

Oracle Healthcare Foundation=8.0.0

Oracle Healthcare Foundation=8.1.0

Oracle Primavera Unifier>=17.7<=17.12

Oracle Primavera Unifier=18.8

and 5 more

● CVE-2021-3449

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it...

rust/openssl-src<111.15.0

debian/openssl

IBM Cognos Analytics<=12.0.0-12.0.1

IBM Cognos Analytics<=11.2.0-11.2.4 FP2

IBM Cognos Analytics<=11.1.1-11.1.7 FP7

OpenSSL OpenSSL>=1.1.1<1.1.1k

and 202 more

● CVE-2021-27906

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

redhat/pdfbox<2.0.23

Apache PDFBox>=2.0.0<=2.0.22

Fedoraproject Fedora=32

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Oracle Banking Corporate Lending Process Management=14.2.0

and 37 more

● CVE-2021-27807

A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

redhat/pdfbox<2.0.23

Apache PDFBox>=2.0.0<=2.0.22

Fedoraproject Fedora=32

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Oracle Banking Trade Finance Process Management=14.2.0

and 26 more

● CVE-2021-23337

`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

redhat/cockpit-ovirt<0:0.15.1-2.el8e

redhat/ovirt-engine-ui-extensions<0:1.2.6-1.el8e

redhat/ovirt-web-ui<0:1.6.9-1.el8e

redhat/nodejs-lodash<4.17.21

npm/lodash-template<=1.0.0

npm/lodash.template<=4.5.0

and 50 more

● CVE-2020-28500

A flaw was found in nodejs-lodash. A Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions is possible.

redhat/cockpit-ovirt<0:0.15.1-2.el8e

redhat/ovirt-engine-ui-extensions<0:1.2.6-1.el8e

redhat/ovirt-web-ui<0:1.6.9-1.el8e

npm/lodash.trim<=4.5.1

npm/lodash.trimend<=4.5.1

npm/lodash-es<4.17.21

and 44 more

● CVE-2020-36179

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

Debian Debian Linux=9.0

and 65 more

● CVE-2020-36183

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.00<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0.<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

and 72 more

● CVE-2020-36182

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

and 72 more

● CVE-2020-36181

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

NetApp Service Level Manager

Debian Debian Linux=9.0

Oracle Agile PLM=9.3.6

and 71 more

● CVE-2020-36180

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

Debian Debian Linux=9.0

and 72 more

● CVE-2020-35728

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka em...

IBM Disconnected Log Collector<=v1.0 - v1.8.2

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<=2.9.10.7

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.9.0<2.9.10.8

Debian Debian Linux=9.0

NetApp Service Level Manager

and 62 more

● CVE-2020-36188

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

IBM Disconnected Log Collector<=v1.0 - v1.8.2

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

and 73 more

● CVE-2020-36189

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind<2.6.7.5

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.8

IBM Disconnected Log Collector<=v1.0 - v1.8.2

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

and 65 more

● CVE-2020-36186

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

and 71 more

● CVE-2020-36187

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

and 71 more

● CVE-2020-36185

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

FasterXML jackson-databind>=2.0.0<2.6.7.5

FasterXML jackson-databind>=2.7.0<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

and 71 more

● CVE-2020-36184

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity...

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.9.10.8

redhat/jackson-databind<2.9.10.8

Netapp Cloud Backup

NetApp Service Level Manager

Debian Debian Linux=9.0

Oracle Agile PLM=9.3.6

and 71 more

● CVE-2020-35460

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

Mpxj Mpxj<8.3.5

Oracle Primavera Unifier>=17.7<=17.12

Oracle Primavera Unifier=16.1

Oracle Primavera Unifier=16.2

Oracle Primavera Unifier=18.8

Oracle Primavera Unifier=19.12

and 1 more

● CVE-2020-17521

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method ca...

Apache Groovy>=2.0.0<=2.4.20

Apache Groovy>=2.5.0<=2.5.13

Apache Groovy>=3.0.0<=3.0.6

Apache Groovy=4.0.0-alpha1

Netapp Snapcenter

Oracle Agile Engineering Data Management=6.2.1.0

and 37 more

● CVE-2020-13956

Apache HttpClient could allow a remote attacker to bypass security restrictions, caused by the improper handling of malformed authority component in request URIs. By passing request URIs to the librar...

redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-1.Final_redhat_00001.1.el6ea

redhat/eap7-httpcomponents-client<0:4.5.13-1.redhat_00001.1.el6ea

redhat/eap7-jboss-ejb-client<0:4.0.37-1.Final_redhat_00001.1.el6ea

and 88 more

● CVE-2020-11979

As mitigation for <a href="https://access.redhat.com/security/cve/CVE-2020-1945">CVE-2020-1945</a> Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user...

redhat/jenkins<0:2.263.3.1612433584-1.el7

redhat/conmon<2:2.0.21-1.rhaos4.5.el7

redhat/jenkins<0:2.263.3.1612434332-1.el7

redhat/machine-config-daemon<0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

redhat/openshift<0:4.5.0-202102050524.p0.git.0.9229406.el7

redhat/openshift-ansible<0:4.5.0-202102031005.p0.git.0.c6839a2.el7

and 147 more

● CVE-2020-8908

A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure.

redhat/eap7-activemq-artemis<0:2.9.0-9.redhat_00019.1.el6ea

redhat/eap7-bouncycastle<0:1.68.0-1.redhat_00001.1.el6ea

redhat/eap7-guava-failureaccess<0:1.0.1-1.redhat_00002.1.el6ea

redhat/eap7-guava-libraries<0:30.1.0-1.redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.13-1.Final_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.27-1.Final_redhat_00001.1.el6ea

and 69 more

● CVE-2020-25020

MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.

Mpxj Mpxj<=8.1.3

Oracle Primavera Unifier>=17.7<=17.12

Oracle Primavera Unifier=16.1

Oracle Primavera Unifier=16.2

Oracle Primavera Unifier=18.8

Oracle Primavera Unifier=19.12

and 1 more

● CVE-2020-36518

A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects.

debian/jackson-databind<=2.9.8-3+deb10u3

redhat/jackson-databind<0:2.14.1-2.el9

redhat/eap7-jackson-databind<0:2.12.6.1-1.redhat_00003.1.el8ea

redhat/eap7-jackson-databind<0:2.12.6.1-1.redhat_00003.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el8

and 88 more

● CVE-2020-14618

Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Mobile App). The supported version that is affected is Prior to 20.6. Difficult to exploit vulnerabili...

Oracle Primavera Unifier<20.6

● CVE-2020-14617

Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform, Mobile App). Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8 and 19.12...

Oracle Primavera Unifier<20.6

Oracle Primavera Unifier>=17.7<=17.12

Oracle Primavera Unifier=16.1

Oracle Primavera Unifier=16.2

Oracle Primavera Unifier=18.8

and 1 more

● CVE-2020-1945

Apache Ant could allow a remote attacker to bypass security restrictions, caused by the use of an insecure temporary directory to store source files. By sending a specially-crafted request, an attacke...

redhat/jenkins<0:2.263.3.1612433584-1.el7

redhat/conmon<2:2.0.21-1.rhaos4.5.el8

redhat/jenkins<0:2.263.3.1612434332-1.el7

redhat/machine-config-daemon<0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

redhat/openshift<0:4.5.0-202102050524.p0.git.0.9229406.el7

redhat/openshift-ansible<0:4.5.0-202102031005.p0.git.0.c6839a2.el7

and 128 more

● CVE-2020-9488

Apache Log4j is vulnerable to a man-in-the-middle attack, caused by improper certificate validation with host mismatch in the SMTP appender. An attacker could exploit this vulnerability to launch a ma...

debian/apache-log4j2

redhat/qpid-cpp<0:1.36.0-31.el6_10a

redhat/qpid-proton<0:0.32.0-1.el6_10

redhat/qpid-cpp<0:1.36.0-31.el7a

redhat/qpid-proton<0:0.32.0-2.el7

redhat/nodejs-rhea<0:1.0.24-1.el8

and 110 more

● CVE-2020-9489

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Pa...

Apache Tika=1.24

Oracle FLEXCUBE Private Banking=12.0.0

Oracle FLEXCUBE Private Banking=12.1.0

Oracle Primavera Unifier>=17.7<=17.12

Oracle Primavera Unifier=16.1

Oracle Primavera Unifier=16.2

and 5 more

● CVE-2020-11620

A flaw was found in jackson-databind 2.x. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as...

redhat/rh-maven35-jackson-databind<0:2.7.6-2.10.el7

IBM Data Risk Manager<=2.0.6

redhat/jackson-databind<2.9.10.4

maven/com.fasterxml.jackson.core:jackson-databind>=2.9.0<=2.9.10.3

FasterXML jackson-databind>=2.9.0<2.9.10.4

Debian Debian Linux=8.0

and 29 more

Latest oracle primavera unifier Vulnerabilities

Company

Resources

Contact