NotCVE - vendor:"Oracle" product:"Jd Edwards Enterpriseone Tools" version:"

Page 13 of 143 results (0.027 seconds)

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-2945

https://notcve.org/view.php?id=CVE-2018-2945

18 Jul 2018 — Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Web Runtime). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products. S... • http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-2946

https://notcve.org/view.php?id=CVE-2018-2946

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-2999

https://notcve.org/view.php?id=CVE-2018-2999

CVSS: 9.8EPSS: 0%CPEs: 41EXPL: 0

CVE-2018-8013 – Gentoo Linux Security Advisory 202401-11

https://notcve.org/view.php?id=CVE-2018-8013

24 May 2018 — In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization. En Apache Batik en versiones 1.x anteriores a la 1.10, cuando se deserializa la subclase de "AbstractDocument", la clase toma una cadena de inputStream como el nombre de clase y lo emplea para llamar al constructor no-arg ... • http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html • CWE-502: Deserialization of Untrusted Data •

CVSS: 6.1EPSS: 0%CPEs: 81EXPL: 3

CVE-2015-9251 – jquery: Cross-site scripting via cross-domain ajax requests

https://notcve.org/view.php?id=CVE-2015-9251

18 Jan 2018 — jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. jQuery en versiones anteriores a la 3.0.0 es vulnerable a ataques de Cross-site Scripting (XSS) cuando se realiza una petición Ajax de dominios cruzados sin la opción dataType. Esto provoca que se ejecuten respuestas de texto/javascript. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applic... • https://github.com/halkichi0308/CVE-2015-9251 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-2658

https://notcve.org/view.php?id=CVE-2018-2658

18 Jan 2018 — Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Web Runtime SEC). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional product... • http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-2659

https://notcve.org/view.php?id=CVE-2018-2659

CVSS: 6.2EPSS: 0%CPEs: 20EXPL: 0

CVE-2017-15707

https://notcve.org/view.php?id=CVE-2017-15707

01 Dec 2017 — In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload. El plugin REST en Apache Struts desde la versión 2.5 hasta la 2.5.14 emplea una librería JSON-lib desactualizada vulnerable y que permite llevar a cabo un ataque de denegación de servicio utilizando una petición maliciosa con una carga útil JSON especialmente manipulada. • http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html • CWE-20: Improper Input Validation •

CVSS: 9.8EPSS: 17%CPEs: 58EXPL: 0

CVE-2017-15095 – jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)

https://notcve.org/view.php?id=CVE-2017-15095

13 Nov 2017 — A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously. Se ha descubierto un error de deserialización en jackson-databind, en versiones anteriores a la 2.8.10 y a la 2.9.1, que podría permitir que un usu... • http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html • CWE-184: Incomplete List of Disallowed Inputs CWE-502: Deserialization of Untrusted Data •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-3517

https://notcve.org/view.php?id=CVE-2017-3517

24 Apr 2017 — Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Web Runtime SEC). The supported version that is affected is 9.2. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of se... • http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html •

1...11 12 13 14 15