CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-14894
https://notcve.org/view.php?id=CVE-2020-14894
21 Oct 2020 — Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications (component: Core). Supported versions that are affected are 12.3.0 and 14.0.0-14.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.1 Base... • https://www.oracle.com/security-alerts/cpuoct2020.html •
CVSS: 7.5EPSS: 3%CPEs: 27EXPL: 0CVE-2019-12399 – kafka: Connect REST API exposes plaintext secrets in tasks endpoint
https://notcve.org/view.php?id=CVE-2019-12399
14 Jan 2020 — When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables. Cuando l... • http://www.openwall.com/lists/oss-security/2020/01/14/1 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 5.8EPSS: 6%CPEs: 7EXPL: 2CVE-2019-11269 – Open Redirector in spring-security-oauth2
https://notcve.org/view.php?id=CVE-2019-11269
12 Jun 2019 — Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-a... • https://packetstorm.news/files/id/153299 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 20%CPEs: 7EXPL: 3CVE-2019-3778 – Open Redirect in spring-security-oauth2
https://notcve.org/view.php?id=CVE-2019-3778
07 Mar 2019 — Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner us... • https://packetstorm.news/files/id/153299 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •