communications_billing_and_revenue_management vulnerabilities

CVEs whose affected-version data names the communications_billing_and_revenue_management package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

17 CVEsRSS

CVE-2021-45105Medium· 5.90dayPoC

4y ago

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial …

▾ Midnightapache · log4jEPSS 100%via NVD

CVE-2021-2351High· 8.3

5y ago

Vulnerability in the Advanced Networking Option component of Oracle Database Server

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network acc…

▾ Twilightoracle · advanced_networking_optionEPSS 2.4%via NVD

CVE-2020-36183High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

▾ Twilightfasterxml · jackson-databindEPSS 4.9%via NVD

CVE-2020-36182High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

▾ Twilightfasterxml · jackson-databindEPSS 4.0%via NVD

CVE-2020-36180High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

▾ Midnightnetapp · cloud_backupEPSS 4.0%via NVD

CVE-2020-36179High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

▾ Midnightnetapp · cloud_backupEPSS 17%via NVD

CVE-2020-36189High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

▾ Twilightfasterxml · jackson-databindEPSS 3.9%via NVD

CVE-2020-36188High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

▾ Midnightfasterxml · jackson-databindEPSS 8.8%via NVD

CVE-2020-36187High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 4.2%via NVD

CVE-2020-36186High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 4.2%via NVD

CVE-2020-36185High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 4.2%via NVD

CVE-2020-36184High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

▾ Midnightnetapp · cloud_backupEPSS 8.4%via NVD

CVE-2020-36181High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

▾ Twilightnetapp · service_level_managerEPSS 4.0%via NVD

CVE-2020-35728High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/jav…

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/jav…

▾ Midnightfasterxml · jackson-databindEPSS 13%via NVD

CVE-2020-25649High· 7.5

5y ago

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

▾ Twilightfasterxml · jackson-databindEPSS 17%via NVD

CVE-2019-10219Medium· 6.1PoC

6y ago

A vulnerability was found in Hibernate-Validator

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS a…

▾ Twilightredhat · hibernate_validatorEPSS 2.2%via NVD

CVE-2019-10086High· 7.3

7y ago

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using…

▾ Twilightapache · commons_beanutilsEPSS 28%via NVD