Oracle Jd Edwards Enterpriseone Tools vulnerabilities, page 5

173 vulnerabilities

Known vulnerabilities in Oracle Jd Edwards Enterpriseone Tools, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CriticalCVE-2020-9547chainguard · eco-java-gradle-2.10 +86 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).EPSS18.38%9.8CriticalCVE-2020-9546chainguard · eco-java-gradle-4.10 +61 morechainguard eco-java-gradle-4.10FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).EPSS4.58%6.1MediumCVE-2020-9281ckeditor +12 moreckeditor ckeditorA cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).EPSS4.31%9.8CriticalCVE-2020-9548chainguard · eco-java-gradle-2.10 +95 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).EPSS18.92%8.8HighCVE-2020-36180chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.EPSS4.09%8.1HighCVE-2020-36187chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.EPSS4.24%8.8HighCVE-2020-36181chainguard · eco-java-gradle-2.10 +114 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.EPSS4.09%8.1HighCVE-2020-36185chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.EPSS4.24%8.8HighCVE-2020-36184chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.EPSS8.36%8.1HighCVE-2020-36183chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.EPSS4.97%8.8HighCVE-2020-36182chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.EPSS4.09%8.8HighCVE-2020-36179chainguard · eco-java-gradle-2.10 +113 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.EPSS17.07%8.1HighCVE-2020-36189chainguard · eco-java-gradle-2.10 +110 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.EPSS3.99%8.1HighCVE-2020-36186chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.EPSS4.24%8.1HighCVE-2020-36188chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.EPSS8.79%7.5HighCVE-2020-25648Alpine Linuxalpine · nss +30 morealpine nssA flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.EPSS3.90%7.5HighCVE-2020-25649apache · iotdb +139 moreapache iotdbA flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.EPSS17.71%7HighCVE-2020-27216apache · beam +264 moreapache beamIn Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.EPSS4.35%6.1MediumCVE-2020-27193ckeditor +9 moreckeditor ckeditorA cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.EPSS2.05%8.8HighCVE-2020-10969chainguard · eco-java-gradle-4.10 +61 morechainguard eco-java-gradle-4.10FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.EPSS3.56%