CVSS: 7.5EPSS: 2%CPEs: 6EXPL: 7CVE-2020-7760 – Regular Expression Denial of Service (ReDoS)
https://notcve.org/view.php?id=CVE-2020-7760
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)* Esto afecta al paquete codemirror versiones anteriores a 5.58.2; el paquete org.apache.marmotta.webjars:codemirror anterior a 5.58.2. La expresión regular vulnerable se encuentra en https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. • https://github.com/codemirror/CodeMirror/commit/55d0333907117c9231ffdf555ae8824705993bbb https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEMARMOTTAWEBJARS-1024450 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1024449 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1024445 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCODEMIRROR-1024448 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCOMPONENTS-1024446 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1024447 https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937 https://www.debian.org/ • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14900
https://notcve.org/view.php?id=CVE-2020-14900
Vulnerability in the Oracle Application Express Group Calendar component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Group Calendar. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Group Calendar, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Group Calendar accessible data as well as unauthorized read access to a subset of Oracle Application Express Group Calendar accessible data. • https://www.oracle.com/security-alerts/cpuoct2020.html •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14898
https://notcve.org/view.php?id=CVE-2020-14898
Vulnerability in the Oracle Application Express Packaged Apps component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Packaged Apps. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Packaged Apps, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Packaged Apps accessible data as well as unauthorized read access to a subset of Oracle Application Express Packaged Apps accessible data. • https://www.oracle.com/security-alerts/cpuoct2020.html •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14899
https://notcve.org/view.php?id=CVE-2020-14899
Vulnerability in the Oracle Application Express Data Reporter component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Data Reporter. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Data Reporter, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Data Reporter accessible data as well as unauthorized read access to a subset of Oracle Application Express Data Reporter accessible data. • https://www.oracle.com/security-alerts/cpuoct2020.html •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14762
https://notcve.org/view.php?id=CVE-2020-14762
Vulnerability in the Oracle Application Express component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having SQL Workshop privilege with network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express accessible data as well as unauthorized read access to a subset of Oracle Application Express accessible data. • https://www.oracle.com/security-alerts/cpuoct2020.html •