CVSS: 8.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-2735
https://notcve.org/view.php?id=CVE-2020-2735
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java VM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java VM. • https://www.oracle.com/security-alerts/cpuapr2020.html •
CVSS: 6.4EPSS: 0%CPEs: 5EXPL: 0CVE-2020-2737
https://notcve.org/view.php?id=CVE-2020-2737
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows high privileged attacker having Create Session, Execute Catalog Role privilege with network access via Oracle Net to compromise Core RDBMS. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Core RDBMS. • https://www.oracle.com/security-alerts/cpuapr2020.html •
CVSS: 10.0EPSS: 0%CPEs: 14EXPL: 0CVE-2020-1953 – apache-commons-configuration: uncontrolled class instantiation when loading YAML files
https://notcve.org/view.php?id=CVE-2020-1953
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application. Apache Commons Configuration usa una biblioteca de terceros para analizar archivos YAML, la cual por defecto permite la instanciación de clases si el YAML incluye sentencias especiales. Apache Commons Configuration versiones 2.2, 2.3, 2.4, 2.5, 2.6 no cambió la configuración predeterminada de esta biblioteca. • https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E https://lists.apache.org/thread.html/r16a2e949e35780c8974cf66104e812410f3904f752df6b66bf292269%40%3Ccommits.servicecomb.apache.org%3E https://lists.apache.org/thread.html/rde2186ad6ac0d6ed8d51af7509244adcf1ce0f9a3b7e1d1dd3b64676%40%3Ccommits.camel.apache.org%3E https://www.oracle.com/security-alerts/cpuoct2020.html https://access.redhat.com/security/cve/CVE-2020-1953 https://bugzilla.redhat.com/show_bug.cgi?id=1815212 • CWE-20: Improper Input Validation •
CVSS: 3.9EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2731
https://notcve.org/view.php?id=CVE-2020-2731
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Core RDBMS executes to compromise Core RDBMS. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Core RDBMS accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Core RDBMS. • https://www.oracle.com/security-alerts/cpujan2020.html •
CVSS: 4.1EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2527
https://notcve.org/view.php?id=CVE-2020-2527
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Index, Create Table privilege with network access via OracleNet to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. • https://www.oracle.com/security-alerts/cpujan2020.html •