Oracle Webcenter Portal vulnerabilities, page 4
155 vulnerabilities
Known vulnerabilities in Oracle Webcenter Portal, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2020-36181chainguard · eco-java-gradle-2.10 +114 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.EPSS4.09%HighCVE-2020-36185chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.EPSS4.24%HighCVE-2020-36184chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.EPSS8.36%HighCVE-2020-36183chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.EPSS4.97%HighCVE-2020-36182chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.EPSS4.09%HighCVE-2020-36179chainguard · eco-java-gradle-2.10 +113 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.EPSS17.07%HighCVE-2020-36189chainguard · eco-java-gradle-2.10 +110 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.EPSS3.99%HighCVE-2020-36186chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.EPSS4.24%HighCVE-2020-36188chainguard · eco-java-gradle-2.10 +115 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.EPSS8.79%HighCVE-2020-25649apache · iotdb +139 moreapache iotdbA flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.EPSS17.71%CriticalCVE-2020-10683chainguard · eco-java-gradle-1.11 +75 morechainguard eco-java-gradle-1.11dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.EPSS7.27%HighCVE-2020-28052apache · karaf +28 moreapache karafAn issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.EPSS7.22%HighCVE-2020-35490chainguard · eco-java-gradle-2.10 +95 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.EPSS6.29%HighCVE-2020-35728chainguard · eco-java-gradle-2.10 +110 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).EPSS12.50%HighCVE-2020-35491chainguard · eco-java-gradle-2.10 +96 morechainguard eco-java-gradle-2.10FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.EPSS7.75%CriticalCVE-2017-7525chainguard · eco-java-gradle-2.10 +63 morechainguard eco-java-gradle-2.10A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.EPSS37.72%CriticalCVE-2017-15095chainguard · eco-java-gradle-2.10 +68 morechainguard eco-java-gradle-2.10A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.EPSS8.36%MediumCVE-2017-15707apache software foundation · apache struts +12 moreapache software foundation apache strutsIn Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.EPSS4.89%MediumCVE-2024-20992oracle corporation · webcenter portal +1 moreoracle corporation webcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Content integration). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Portal accessible data as well as unauthorized read access to a subset of Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N).EPSS0.30%CriticalCVE-2019-16943chainguard · eco-java-gradle-2.10 +96 morechainguard eco-java-gradle-2.10A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.EPSS4.90%