CVSS: 7.5EPSS: 0%CPEs: 73EXPL: 0CVE-2020-25649 – jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)
https://notcve.org/view.php?id=CVE-2020-25649
22 Oct 2020 — A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity. Se encontró un fallo en FasterXML Jackson Databind, donde no tenía la expansión de entidad asegurada apropiadamente. Este fallo permite una vulnerabilidad a ataques de tipo XML external entity (XXE). • https://bugzilla.redhat.com/show_bug.cgi?id=1887664 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-1952
https://notcve.org/view.php?id=CVE-2020-1952
27 Apr 2020 — An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely. Se encontró un problema en Apache IoTDB versiones 0.9.0 hasta 0.9.1 y versiones 0.8.0 hasta 0.8.2. Al iniciar IoTDB, se expone el puerto JMX 31999 sin ninguna certificación. Entonces, los clientes podrían ejecutar el código remotamente. • https://lists.apache.org/thread.html/r3d2ff899ead64d2952fdc1fbb1f520ca42011ed2b4c7f786e921f6b9%40%3Cdev.iotdb.apache.org%3E • CWE-295: Improper Certificate Validation •