CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-14741
https://notcve.org/view.php?id=CVE-2020-14741
21 Oct 2020 — Vulnerability in the Database Filesystem component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Resource, Create Table, Create View, Create Procedure, Dbfs_role privilege with network access via Oracle Net to compromise Database Filesystem. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Da... • https://www.oracle.com/security-alerts/cpuoct2020.html •
CVSS: 8.0EPSS: 1%CPEs: 5EXPL: 0CVE-2020-2968
https://notcve.org/view.php?id=CVE-2020-2968
15 Jul 2020 — Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise Java VM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java VM, attacks may significantly impact additional products. ... • https://www.oracle.com/security-alerts/cpujul2020.html •
CVSS: 6.6EPSS: 1%CPEs: 5EXPL: 2CVE-2020-2969 – Oracle Database Password Hash Unauthorized Access
https://notcve.org/view.php?id=CVE-2020-2969
15 Jul 2020 — Vulnerability in the Data Pump component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows high privileged attacker having DBA role account privilege with network access via Oracle Net to compromise Data Pump. Successful attacks of this vulnerability can result in takeover of Data Pump. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). • https://packetstorm.news/files/id/179027 •
CVSS: 4.1EPSS: 0%CPEs: 4EXPL: 3CVE-2020-2978 – Oracle RMAN Missing Auditing
https://notcve.org/view.php?id=CVE-2020-2978
15 Jul 2020 — Vulnerability in the Oracle Database - Enterprise Edition component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA role account privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition. While the vulnerability is in Oracle Database - Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerab... • https://packetstorm.news/files/id/172183 •
CVSS: 7.0EPSS: 93%CPEs: 77EXPL: 19CVE-2020-9484 – tomcat: deserialization flaw in session persistence storage leading to RCE
https://notcve.org/view.php?id=CVE-2020-9484
20 May 2020 — When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d)... • https://packetstorm.news/files/id/157924 • CWE-502: Deserialization of Untrusted Data •
CVSS: 3.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2734
https://notcve.org/view.php?id=CVE-2020-2734
15 Apr 2020 — Vulnerability in the RDBMS/Optimizer component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Execute on DBMS_SQLTUNE privilege with network access via Oracle Net to compromise RDBMS/Optimizer. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS/Optimiz... • https://www.oracle.com/security-alerts/cpuapr2020.html •
CVSS: 8.0EPSS: 1%CPEs: 5EXPL: 0CVE-2020-2735
https://notcve.org/view.php?id=CVE-2020-2735
15 Apr 2020 — Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java VM, attacks may significantly impact additional products. Successful attacks of this... • https://www.oracle.com/security-alerts/cpuapr2020.html •
CVSS: 6.4EPSS: 1%CPEs: 5EXPL: 0CVE-2020-2737
https://notcve.org/view.php?id=CVE-2020-2737
15 Apr 2020 — Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows high privileged attacker having Create Session, Execute Catalog Role privilege with network access via Oracle Net to compromise Core RDBMS. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Core RDBMS. • https://www.oracle.com/security-alerts/cpuapr2020.html •
CVSS: 10.0EPSS: 3%CPEs: 14EXPL: 0CVE-2020-1953 – apache-commons-configuration: uncontrolled class instantiation when loading YAML files
https://notcve.org/view.php?id=CVE-2020-1953
13 Mar 2020 — Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application. Apache Commons Configuration usa una biblioteca de terceros para analizar archivos YAML... • https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E • CWE-20: Improper Input Validation •
CVSS: 3.9EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2731
https://notcve.org/view.php?id=CVE-2020-2731
15 Jan 2020 — Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Core RDBMS executes to compromise Core RDBMS. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some... • https://www.oracle.com/security-alerts/cpujan2020.html •