CVSS: 10.0EPSS: 0%CPEs: 14EXPL: 0CVE-2020-1953 – apache-commons-configuration: uncontrolled class instantiation when loading YAML files
https://notcve.org/view.php?id=CVE-2020-1953
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application. Apache Commons Configuration usa una biblioteca de terceros para analizar archivos YAML, la cual por defecto permite la instanciación de clases si el YAML incluye sentencias especiales. Apache Commons Configuration versiones 2.2, 2.3, 2.4, 2.5, 2.6 no cambió la configuración predeterminada de esta biblioteca. • https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E https://lists.apache.org/thread.html/r16a2e949e35780c8974cf66104e812410f3904f752df6b66bf292269%40%3Ccommits.servicecomb.apache.org%3E https://lists.apache.org/thread.html/rde2186ad6ac0d6ed8d51af7509244adcf1ce0f9a3b7e1d1dd3b64676%40%3Ccommits.camel.apache.org%3E https://www.oracle.com/security-alerts/cpuoct2020.html https://access.redhat.com/security/cve/CVE-2020-1953 https://bugzilla.redhat.com/show_bug.cgi?id=1815212 • CWE-20: Improper Input Validation •
CVSS: 3.9EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2731
https://notcve.org/view.php?id=CVE-2020-2731
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Core RDBMS executes to compromise Core RDBMS. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Core RDBMS accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Core RDBMS. • https://www.oracle.com/security-alerts/cpujan2020.html •
CVSS: 4.1EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2527
https://notcve.org/view.php?id=CVE-2020-2527
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Index, Create Table privilege with network access via OracleNet to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. • https://www.oracle.com/security-alerts/cpujan2020.html •
CVSS: 6.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-2515
https://notcve.org/view.php?id=CVE-2020-2515
Vulnerability in the Database Gateway for ODBC component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session privilege with network access via OracleNet to compromise Database Gateway for ODBC. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Database Gateway for ODBC accessible data as well as unauthorized read access to a subset of Database Gateway for ODBC accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Database Gateway for ODBC. CVSS 3.0 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). • https://www.oracle.com/security-alerts/cpujan2020.html •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2511
https://notcve.org/view.php?id=CVE-2020-2511
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via OracleNet to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Core RDBMS. • https://www.oracle.com/security-alerts/cpujan2020.html •