CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2019-2913
https://notcve.org/view.php?id=CVE-2019-2913
16 Oct 2019 — Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via OracleNet to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. • http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-2734
https://notcve.org/view.php?id=CVE-2019-2734
16 Oct 2019 — Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session, Execute on DBMS_ADVISOR privilege with network access via OracleNet to compromise Core RDBMS. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Core RDBMS accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2018-2875
https://notcve.org/view.php?id=CVE-2018-2875
16 Oct 2019 — Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via OracleNet to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. • http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html •
CVSS: 9.8EPSS: 0%CPEs: 65EXPL: 0CVE-2019-16942 – jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*
https://notcve.org/view.php?id=CVE-2019-16942
01 Oct 2019 — A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp... • https://access.redhat.com/errata/RHSA-2019:3901 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-502: Deserialization of Untrusted Data •
CVSS: 7.6EPSS: 0%CPEs: 4EXPL: 0CVE-2019-2776
https://notcve.org/view.php?id=CVE-2019-2776
23 Jul 2019 — Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any Index privilege with network access via OracleNet to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to ... • http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2019-2749
https://notcve.org/view.php?id=CVE-2019-2749
23 Jul 2019 — Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data and unauthorized abili... • http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2019-2518
https://notcve.org/view.php?id=CVE-2019-2518
23 Apr 2019 — Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise Java VM. Successful attacks of this vulnerability can result in takeover of Java VM. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html •
CVSS: 9.8EPSS: 3%CPEs: 55EXPL: 0CVE-2018-14719 – jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes
https://notcve.org/view.php?id=CVE-2018-14719
02 Jan 2019 — FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization. Las versiones 2.x de FasterXML jackson-databind anteriores a la 2.9.7 podrían permitir a los atacantes remotos ejecutar código arbitrario aprovechando un fallo para bloquear las clases blaze-ds-opt y blaze-ds-core de deserialización polimórfica. A flaw was discovered in jackson-databind, where it would p... • https://access.redhat.com/errata/RHBA-2019:0959 • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.5EPSS: 2%CPEs: 13EXPL: 1CVE-2018-1000873 – jackson-modules-java8: DoS due to an Improper Input Validation
https://notcve.org/view.php?id=CVE-2018-1000873
20 Dec 2018 — Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8. Fasterxml Jackson, en versiones anteriores a la 2.9.8, contiene una vulnerabilidad CWE-20: validación de entradas incorrecta ... • https://bugzilla.redhat.com/show_bug.cgi?id=1665601 • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 3%CPEs: 42EXPL: 0CVE-2018-10237 – guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service
https://notcve.org/view.php?id=CVE-2018-10237
26 Apr 2018 — Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable. Asignación de memoria ... • http://www.securitytracker.com/id/1041707 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-770: Allocation of Resources Without Limits or Throttling •