Lucene search

K
OracleEnterprise Repository12.1.3.0.0

10 matches found

CVE
CVE
added 2019/10/23 8:15 p.m.259 views

CVE-2019-12415

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

5.5CVSS6.7AI score0.00022EPSS
CVE
CVE
added 2018/07/09 8:29 p.m.242 views

CVE-2018-1000613

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deseri...

9.8CVSS8.6AI score0.04619EPSS
CVE
CVE
added 2018/05/11 8:29 p.m.216 views

CVE-2018-1258

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

8.8CVSS9AI score0.0016EPSS
CVE
CVE
added 2019/03/28 10:29 p.m.199 views

CVE-2019-0222

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.

7.5CVSS7.4AI score0.11029EPSS
CVE
CVE
added 2018/06/05 1:29 p.m.178 views

CVE-2018-1000180

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta ...

7.5CVSS7.1AI score0.00221EPSS
CVE
CVE
added 2018/05/24 4:29 p.m.164 views

CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

9.8CVSS8.6AI score0.00723EPSS
CVE
CVE
added 2019/05/28 7:29 p.m.161 views

CVE-2019-0188

Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.

7.5CVSS7.5AI score0.01956EPSS
CVE
CVE
added 2018/09/10 8:29 p.m.142 views

CVE-2018-11775

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.

7.4CVSS7.1AI score0.0084EPSS
CVE
CVE
added 2018/10/17 1:31 a.m.64 views

CVE-2018-3246

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle We...

7.5CVSS7.4AI score0.01699EPSS
CVE
CVE
added 2017/08/08 3:29 p.m.44 views

CVE-2017-10048

Vulnerability in the Oracle Enterprise Repository component of Oracle Fusion Middleware (subcomponent: Web Interface). Supported versions that are affected are 11.1.1.7.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

8.2CVSS8.2AI score0.01606EPSS