CVSS: 9.8EPSS: 0%CPEs: 79EXPL: 0CVE-2020-10683 – dom4j: XML External Entity vulnerability in default SAX parser
https://notcve.org/view.php?id=CVE-2020-10683
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j. dom4j versiones anteriores a 2.0.3 y versiones 2.1.x anteriores a 2.1.3, permite DTDs y External Entities por defecto, lo que podría permitir ataques de tipo XXE. Sin embargo, existe una documentación externa popular de OWASP que muestra cómo habilitar el comportamiento seguro no predeterminado en cualquier aplicación que use dom4j. • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html https://bugzilla.redhat.com/show_bug.cgi?id=1694235 https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658 https://github.com/dom4j/dom4j/commits/version-2.0.3 https://github.com/dom4j/dom4j/issues/87 https://github.com/dom4j/dom4j/releases/tag/version-2.1.3 https://lists.apache.org/thread.html/r51f3f9801058 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 4.3EPSS: 0%CPEs: 101EXPL: 0CVE-2020-9488 – log4j: improper validation of certificate with host mismatch in SMTP appender
https://notcve.org/view.php?id=CVE-2020-9488
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1 Validación incorrecta del certificado con desajuste de host en el apéndice SMTP de Apache Log4j. Esto podría permitir que una conexión SMTPS fuera interceptada por un ataque de tipo man-in-the-middle que podría filtrar cualquier mensaje de registro enviado a través de ese appender. Corregido en Apache Log4j 2.12.3 y 2.13.1 • https://issues.apache.org/jira/browse/LOG4J2-2819 https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a%40%3Cjira.kafka.apache.org%3E https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05%40%3Cdev.zookeeper.apache.org%3E https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881%40%3Cissues.hive.apache.org%3E https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f%40%3Cissues.hive.apache.org%3E https://lists.apache.o • CWE-295: Improper Certificate Validation •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2608
https://notcve.org/view.php?id=CVE-2015-2608
Unspecified vulnerability in (1) the Oracle Communications Diameter Signaling Router (DSR) component in Oracle Communications Applications 4.1.6 and earlier, 5.1.0 and earlier, 6.0.2 and earlier, and 7.1.0 and earlier; (2) the Oracle Communications Performance Intelligence Center Software component in Oracle Communications Applications 9.0.3 and earlier and 10.1.5 and earlier; (3) the Oracle Communications Policy Management component in Oracle Communications Applications 9.9.0 and earlier, 10.5.0 and earlier, 11.5.0 and earlier, and 12.1.0 and earlier; and (4) the Oracle Communications Tekelec HLR Router component in Oracle Communications Applications 4.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to PMAC. Vulnerabilidad no especificada en los componentes (1) Oracle Communications Diameter Signaling Router (DSR) en Oracle Communications Applications 4.1.6 y versiones anteriores, 5.1.0 y versiones anteriores, 6.0.2 y versiones anteriores y 7.1.0 y versiones anteriores; (2) Oracle Communications Performance Intelligence Center Software en Oracle Communications Applications 9.0.3 y versiones anteriores y 10.1.5 y versiones anteriores; (3) Oracle Communications Policy Management en Oracle Communications Applications 9.9.0 y versiones anteriores, 10.5.0 y versiones anteriores, 11.5.0 y versiones anteriores y 12.1.0 y versiones anteriores y (4) Oracle Communications Tekelec HLR Router en Oracle Communications Applications 4.0.0 permite a atacantes remotos afectar la confidencialidad, la integridad y la disponibilidad a través de vectores relacionados con PMAC. • http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html http://www.securitytracker.com/id/1033900 •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-4793
https://notcve.org/view.php?id=CVE-2015-4793
Unspecified vulnerability in the Oracle Communications Convergence component in Oracle Communications Applications 2.0 and 3.0.1 allows remote attackers to affect confidentiality via unknown vectors related to Mail Proxy. Vulnerabilidad no especificada en el componente Oracle Communications Convergence en Oracle Communications Applications 2.0 y 3.0.1 permite a atacantes remotos afectar a la confidencialidad a través de vectores desconocidos relacionados con Mail Proxy. • http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html http://www.securitytracker.com/id/1033900 •
CVSS: 7.6EPSS: 0%CPEs: 3EXPL: 0CVE-2014-6598
https://notcve.org/view.php?id=CVE-2014-6598
Unspecified vulnerability in the Oracle Communications Diameter Signaling Router component in Oracle Communications Applications 3.x, 4.x, and 5.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Signaling - DPI. Vulnerabilidad no especificada en el componente Oracle Communications Diameter Signaling Router en Oracle Communications Applications 3.x, 4.x, y 5.0 permite a atacantes remotos afectar la confidencialidad, integridad, y disponibilidad a través de vectores relacionados con Signaling - DPI. • http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html http://www.securitytracker.com/id/1031590 •