Oracle Agile Product Lifecycle Management vulnerabilities, page 5
151 vulnerabilities
Known vulnerabilities in Oracle Agile Product Lifecycle Management, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2020-36187chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.EPSS4.24%HighCVE-2020-36181chainguard · eco-java-gradle-2.10 +114 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.EPSS4.09%HighCVE-2020-36185chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.EPSS4.24%HighCVE-2020-36184chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.EPSS8.36%HighCVE-2020-36183chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.EPSS4.97%HighCVE-2020-36182chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.EPSS4.09%HighCVE-2020-36179chainguard · eco-java-gradle-2.10 +113 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.EPSS17.07%HighCVE-2020-36189chainguard · eco-java-gradle-2.10 +110 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.EPSS3.99%HighCVE-2020-36186chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.EPSS4.24%HighCVE-2020-36188chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.EPSS8.79%MediumCVE-2020-17521apache software foundation · apache groovy +76 moreapache software foundation apache groovyApache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.EPSS1.03%HighCVE-2020-25649apache · iotdb +139 moreapache iotdbA flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.EPSS17.71%MediumCVE-2020-27193ckeditor +9 moreckeditor ckeditorA cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.EPSS2.05%CriticalCVE-2020-10683chainguard · eco-java-gradle-1.11 +75 morechainguard eco-java-gradle-1.11dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.EPSS7.27%HighCVE-2020-10969chainguard · eco-java-gradle-4.10 +61 morechainguard eco-java-gradle-4.10FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.EPSS3.56%HighCVE-2020-10672chainguard · eco-java-gradle-4.10 +61 morechainguard eco-java-gradle-4.10FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).EPSS3.06%HighCVE-2020-10968chainguard · eco-java-gradle-4.10 +61 morechainguard eco-java-gradle-4.10FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).EPSS3.66%HighCVE-2020-10673chainguard · eco-java-gradle-2.10 +101 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).EPSS8.03%HighCVE-2020-24750chainguard · eco-java-gradle-2.10 +98 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.EPSS7.33%HighCVE-2020-24616chainguard · eco-java-gradle-2.10 +95 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).EPSS7.61%