CVE-2020-1938

CVE-2020-1938 (Tomcat AJP vulnerability) : The issue affects Apache Tomcat where the AJP Connector, enabled by default in several legacy releases, could be reached through untrusted networks. An attacker could exploit the configured AJP path to read arbitrary files in the web application and pote...

CVE-2019-15752

CVE-2019-15752 affects Docker Desktop Community Edition prior to 2.1.0.1. A local attacker can escalate privileges by placing a Trojan horse docker-credential-wincred.exe in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, then rely on an admin/service user authenticating with Do...

CVE-2019-14892

CVE-2019-14892 — In jackson-databind, polymorphic deserialization can be exploited via JNDI gadgets (commons-configuration 1/2) to achieve remote code execution. Affected: jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. Remediation: upgrade to a fixed jackson-databind release (e.g...

CVE-2022-37021

Apache Geode is vulnerable to deserialization of untrusted data when using JMX over RMI on Java 8 in versions up to 1.12.5, 1.13.4, and 1.14.0. The advised fix is to upgrade to Geode 1.15 with Java 11. If Java 11 is not possible, upgrade to Geode 1.15 and start Locators/Servers with --J=-Dgeode.e...

CVE-2017-15692

Summary: CVE-2017-15692 affects Apache Geode prior to v1.4.0. The TcpServer in the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the locator and certain classes are on the classpath, remote code execution may be possible. Exploitation status an...

CVE-2014-0048

CVE-2014-0048 affects Docker before 1.6.0. The issue is that some programs and scripts in Docker were downloaded via HTTP and then executed or used in unsafe ways, enabling potential exposure of data or control depending on use. Multiple sources (NVD, OSV, OSV Ubuntu, Nessus/NASL) corroborate thi...