CVE-2020-11022

CVE-2020-11022 affects jQuery versions >=1.2 and =3.5.0 or apply vendor guidance where applicable.

CVE-2020-1938

CVE-2020-1938 (Tomcat AJP vulnerability) : The issue affects Apache Tomcat where the AJP Connector, enabled by default in several legacy releases, could be reached through untrusted networks. An attacker could exploit the configured AJP path to read arbitrary files in the web application and pote...

CVE-2015-9251

CVE-2015-9251 affects jQuery before 3.0.0, enabling XSS when a cross-domain Ajax request omits the dataType option and text/javascript responses are executed. Connected advisories confirm the issue and indicate an upgrade resolves it; remediation is to upgrade jQuery to a fixed version as provide...

CVE-2019-11358

CVE-2019-11358 is a prototype pollution vulnerability in jQuery (before 3.4.0) where mishandling of extend(true, {}, ...) can extend Object.prototype if an unsanitized source object has an enumerable proto property. The Core issue is triggered when a polluted prototype is introduced via nested ob...

CVE-2020-9484

CVE-2020-9484 is a deserialization flaw in Apache Tomcat that, under a specific FileStore PersistenceManager configuration and a crafted request, can trigger remote code execution. Affected are Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61, and 7.0.0 to 7.0.107 when the...

CVE-2020-1935

CVE-2020-1935 affects Apache Tomcat across multiple branches: 9.0.0.M1–9.0.30, 8.5.0–8.5.50, and 7.0.0–7.0.99. It stems from HTTP header parsing that can mishandle end-of-line and Transfer-Encoding, enabling HTTP Request Smuggling when Tomcat sits behind certain reverse proxies. Impact is informa...

CVE-2021-45105

Summary of CVE-2021-45105 (Log4j2) : Affected Log4j 2.x versions 2.0-alpha1 through 2.16.0 (except 2.12.3 and 2.3.1) are vulnerable to denial of service via uncontrolled recursion triggered by self-referential lookups in Thread Context Map data. The root cause is improper handling of self-referen...

CVE-2021-44832

CVE-2021-44832 affects Apache Log4j2 up to 2.17.0 (except 2.3.2 and 2.12.4) when a configuration uses a JDBC Appender with a JNDI LDAP data source URI and an attacker controls the LDAP server. The root cause is JNDI LDAP data source handling enabling RCE. Impact: remote code execution with the de...

CVE-2021-25329

The CVE-2021-25329 entry is tied to an incomplete fix for CVE-2020-9484 in Apache Tomcat. In affected releases (Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61, and 7.0.0 to 7.0.107) a configuration edge case that was deemed highly unlikely could leave the Tomcat instance vulnerab...

CVE-2020-13935

CVE-2020-13935 affects Apache Tomcat: the WebSocket frame payload length was not properly validated, which could trigger an infinite loop and allow DoS via multiple invalid payloads. Affected: Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, and 7.0.27 to 7.0.104. The initial d...

CVE-2021-25122

CVE-2021-25122 affects Apache Tomcat across multiple lines: 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, and 8.5.0 to 8.5.61. The issue allows duplicating request headers and a limited amount of request body from one request to another, enabling cross-user visibility of results (information disclosur...

CVE-2016-7103

CVE-2016-7103 is a cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0, exploitable via the closeText parameter of the Dialog widget. The issue allows remote script/HTML injection. Remediation per connected documents is to upgrade to jQuery UI 1.12.0 or later (fixed version).

CVE-2020-11996

CVE-2020-11996 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35, and 8.5.0 to 8.5.55, where a specially crafted sequence of HTTP/2 requests could trigger high CPU and make the server unresponsive. Multiple connected advisories confirm this DoS through HTTP/2 traffic. Publ...

CVE-2021-26272

CVE-2021-26272 is a ReDoS in CKEditor 4 Autolink: by pasting crafted URL-like text and pressing Enter/Space, a victim can trigger a denial-of-service. The publicly documented detail confirms CKEditor 4.x up to before 4.16 is affected; remediation is to upgrade to CKEditor 4.16+ or apply a fix as ...

CVE-2020-13934

CVE-2020-13934 affects multiple Apache Tomcat releases (8.5.1–8.5.56, 9.0.x, 10.0.x up to M6) where an h2c direct connection didn’t release the HTTP/1.1 processor after upgrading to HTTP/2, potentially causing OutOfMemoryError and denial of service. Public advisories across vendors and distributi...

CVE-2017-5645

CVE-2017-5645 affects Apache Log4j 2.x prior to 2.8.2. The vulnerability arises when using a TCP/UDP socket server to receive serialized log events from another application; a crafted binary payload can be deserialized to execute arbitrary code. The documented impact is remote code execution via ...

CVE-2021-26271

CVE-2021-26271 affects CKEditor 4 before 4.16. An attacker could trigger a ReDoS-type DoS by persuading a victim to paste crafted text into the Styles input of dialogs (Advanced Tab in the Dialogs plugin). Affected versions are CKEditor 4.x prior to 4.16; remediation is to upgrade to 4.16 or newe...

CVE-2020-9488

CVE-2020-9488 affects the Apache Log4j2 SMTP appender. The issue is improper validation of the SSL/TLS certificate when the host name does not match, potentially allowing a man-in-the-middle to intercept SMTPS traffic and leak log messages. The concrete remediation is to upgrade to affected relea...

CVE-2019-20330

CVE-2019-20330 affects FasterXML jackson-databind 2.x before 2.9.10.2, which lacks blocking for net.sf.ehcache in deserialization. This is a deserialization-side issue with high–critical impact potential; remediation is to upgrade to jackson-databind 2.9.10.2 or newer as indicated by connected IB...

CVE-2019-16942

CVE-2019-16942 affects FasterXML jackson-databind 2.0.0–2.9.10. When Default Typing is enabled for an externally exposed JSON endpoint and the service includes the commons-dbcp 1.4 jar on the classpath, with an accessible RMI endpoint, the vulnerability can allow execution of a malicious payload ...

CVE-2019-14379

CVE-2019-14379 affects FasterXML jackson-databind prior to 2.9.9.2, where default typing mishandling when ehcache is present (via net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) leads to remote code execution. Affected component is jackson-databind’s data-binding implementatio...

CVE-2019-0227

The CVE-2019-0227 entry concerns an SSRF in Apache Axis 1.4 (last released in 2006). The connected IBM bulletins confirm Axis 1.x vulnerability details and state Axis 2 is the successor, with 1.7.9 (Axis2) being not vulnerable. Affected Axis 1.x components are legacy; remediation is to upgrade to...

CVE-2020-24750

CVE-2020-24750 affects FasterXML jackson-databind 2.x prior to 2.9.10.6, where the interaction between serialization gadgets and typing is mishandled (CWE-502). This deserialization flaw could enable exploitation via untrusted data; the connected IBM/Cloudera doc confirms the CVE entry but does n...

CVE-2021-32808

CKEditor 4.x clipboard Widget plugin vulnerability (CVE-2021-32808) arises from improper validation of widget HTML when used with the undo feature, allowing a remote attacker to trigger JavaScript execution in the victim’s browser. Affected: CKEditor 4 plugins with version >= 4.13.0. Remediati...

CVE-2021-2351

CVE-2021-2351 affects Oracle Database Server’s Advanced Networking Option, with affected versions 12.1.0.2, 12.2.0.1, and 19c. The vulnerability allows unauthenticated network access via Oracle Net to compromise the Advanced Networking Option, with access requiring user interaction (UI_R) and ris...

CVE-2018-8032

CVE-2018-8032 affects Apache Axis 1.x (up to 1.4) with a cross-site scripting (XSS) vulnerability in the default servlet/services. This vulnerability is documented in IBM/PM security bulletins linked to Axis, confirming an XSS flaw (CWE-79) in Axis 1.x and indicating broader IBM product exposure....

CVE-2018-14718

CVE-2018-14718 affects FasterXML jackson-databind 2.x (pre-2.9.7). Description: remote code execution via deserialization due to failure to block the slf4j-ext class from polymorphic deserialization. IBM watsonx.data is listed as affected (versions 1.0.0–2.0.0 in some bulletins; later bulletins s...

CVE-2020-24616

The CVE-2020-24616 vulnerability affects FasterXML jackson-databind 2.x prior to 2.9.10.6, arising from the interaction between serialization gadgets and typing (related to br.com.anteros.dbcp.AnterosDBCPDataSource). Root cause is unsafe deserialization via Gadget chains in Jackson Databind. Impa...

CVE-2019-14439

CVE-2019-14439 describes a polymorphic typing deserialization issue in FasterXML jackson-databind 2.x prior to 2.9.9.2. When Default Typing is enabled (globally or for a property) and logback is in the classpath, an externally exposed JSON endpoint may be vulnerable to unsafe deserialization. Aff...

CVE-2021-1996

CVE-2021-1996 affects Oracle WebLogic Server (Oracle Fusion Middleware, Web Services component). Affected versions include 10.3.6.0.0 and 12.1.3.0.0. The issue allows a high-privilege attacker with network access via HTTP to compromise the server, with human interaction required and potential una...

CVE-2017-10333

CVE-2017-10333 affects the Siebel UI Framework, specifically the EAI subcomponent, in Oracle Siebel CRM. Affected versions are 16.0 and 17.0. The vulnerability allows an attacker with network access via HTTP and low privileges to compromise Siebel UI Framework, potentially leading to unauthorized...

CVE-2017-10264

CVE-2017-10264 affects Oracle Siebel CRM, specifically the Siebel UI Framework subcomponent UIF Open UI. Affected versions: 16.0 and 17.0. The vulnerability allows an unauthenticated attacker, over HTTP, to access the UI Framework and can lead to partial denial of service (partial DOS) of Siebel ...

CVE-2020-2564

CVE-2020-2564 affects Oracle Siebel CRM’s Siebel UI Framework (component: EAI ) with affected versions up to 19.10. An unauthenticated, network-accessible attacker via HTTP can cause unauthorized read access to a subset of Siebel UI Framework data. The root cause is described as an access-control...

CVE-2017-10302

CVE-2017-10302 affects Oracle Siebel CRM, specifically the Siebel UI Framework (subcomponent: UIF Open UI). Affected versions are 16.0 and 17.0 . The vulnerability allows an unauthenticated, network-hosted attacker to access via HTTP and, after user interaction, may lead to unauthorized update/in...

CVE-2017-10263

CVE-2017-10263 affects Oracle Siebel CRM’s Siebel UI Framework (subcomponent: UIF Open UI) with affected versions 16.0 and 17.0. The connected documents confirm an unauthenticated, network-accessible vulnerability over HTTP that requires user interaction and can lead to unauthorized data access a...

CVE-2017-3325

Oracle Siebel CRM 16.1.x is affected by CVE-2017-3325 in the Siebel UI Framework (subcomponent: EAI). The connected NASL/Tenable entry confirms additional related issues (CVE-2017-3330 and CVE-2017-3264) within the same CPU advisory. The vulnerability allows an unauthenticated attacker to access ...

CVE-2020-14531

The CVE-2020-14531 vulnerability affects Oracle Siebel CRM's Siebel UI Framework (SWSE Server) and is exploitable on affected versions (20.6 and earlier). An unauthenticated attacker with network access over HTTP can compromise the Siebel UI Framework, but exploitation requires user interaction. ...

CVE-2017-3264

CVE-2017-3264 affects Oracle Siebel CRM 16.1 and specifically targets the Siebel UI Framework, under the Open UI subcomponent. The vulnerability is described as allowing a low-privileged, network-accessible attacker (via HTTP) to compromise Siebel UI Framework, potentially leading to unauthorized...

CVE-2020-2560

CVE-2020-2560 affects the Oracle Siebel CRM Siebel UI Framework (component: SWSE Server). Connected sources indicate affected versions are 19.10 and earlier. The vulnerability allows an unauthenticated attacker with network access over HTTP to compromise Siebel UI Framework, with attacks requirin...

CVE-2016-5468

Summary: CVE-2016-5468 affects Oracle Siebel CRM (8.1.1, 8.2.2, IP2014, IP2015, IP2016) and specifically the Siebel UI Framework subcomponent (EAI). What’s vulnerable: A vulnerability in the Siebel UI Framework (EAI) that can be exploited by a remote, authenticated attacker over network access (H...

CVE-2017-10315

Summary: CVE-2017-10315 concerns the Siebel UI Framework (subcomponent: UIF Open UI) in Oracle Siebel CRM. Affected are Siebel versions 16.0 and 17.0. The vulnerability enables an unauthenticated attacker, over HTTP, to exploit via user interaction to gain unauthorized read/update/delete access t...

CVE-2018-2959

CVE-2018-2959 affects Oracle Siebel CRM’s Siebel UI Framework – UIF Open UI . The vulnerability targets version 18.0 and can be triggered by an unauthenticated attacker over HTTP to access or modify data within the Siebel UI Framework. The exposed impact, as described, includes potential unauthor...

CVE-2020-2559

The CVE-2020-2559 entry describes a vulnerability in the Siebel UI Framework (UIF Open UI) within Oracle Siebel CRM. Affected are version 19.7 and earlier. The flaw allows an unauthenticated attacker with network access over HTTP to compromise the UI Framework, resulting in unauthorized read acce...

CVE-2016-5464

Summary (CVE-2016-5464) : Oracle Siebel CRM, versions 8.1.1, 8.2.2, IP2014–IP2016, has an unspecified vulnerability in the Siebel UI Framework component that allows a remote, authenticated attacker (via HTTP against SWSE Server related vectors) to affect data integrity. The issue is reported as r...

CVE-2019-2935

Oracle Siebel CRM Siebel UI Framework (EAI) is affected by CVE-2019-2935. Affected are versions 19.8 and prior. The vulnerability enables unauthenticated attackers over HTTP to read a subset of Siebel UI Framework data. The CVSS 3.1 base score is 5.3 (medium). The connected documents do not provi...

CVE-2020-2738

CVE-2020-2738 affects Oracle Siebel CRM’s Siebel UI Framework (component: EAI, SWSE). Affected: Siebel 20.2 and earlier; vulnerability allows a low-privilege, network-accessing (via HTTP) attacker to read a subset of data from the UI Framework. Root cause is unauthorized read access due to the vu...

CVE-2016-5463

CVE-2016-5463 affects Oracle Siebel CRM with Siebel UI Framework (subcomponent EAI) across versions 8.1.1, 8.2.2, IP2014, IP2015, IP2016. The vulnerability allows remote authenticated users to affect integrity via vectors related to the SWSE Server; attack requires network access via HTTP and is ...

CVE-2019-2857

CVE-2019-2857 affects Oracle Siebel CRM’s UIF Open UI under the Siebel UI Framework. Affected version set is 19.0 and prior. The vulnerability enables a low‑privileged actor who can reach the server over HTTP to access and potentially modify data within the Siebel UI Framework, with the attacker ...

CVE-2016-5451

CVE-2016-5451 affects Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, IP2016, via the Siebel UI Framework (subcomponent: EAI). The Nessus/NVD entries describe an unspecified vulnerability that allows a remote authenticated attacker to compromise confidentiality and integrity, with vectors related...

CVE-2017-3330

CVE-2017-3330 affects Oracle Siebel CRM 16.1 Open UI (Siebel UI Framework). The vulnerability allows a low-privileged, network-accessible attacker over HTTP to compromise Siebel UI Framework. Successful attacks require user interaction and may lead to unauthorized access to critical data or to up...