primavera_gateway vulnerabilities

CVEs whose affected-version data names the primavera_gateway package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

20 CVEsRSS

CVE-2022-23437Medium· 6.5

4y ago

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resourc…

▾ Sunlitapache · xerces-jEPSS 12%via NVD

CVE-2021-41183Medium· 6.5

4y ago

jQuery-UI is the official jQuery user interface library

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI …

▾ Sunlitjqueryui · jquery_uiEPSS 8.5%via NVD

CVE-2021-36374Medium· 5.5

5y ago

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using…

▾ Sunlitapache · antEPSS 2.6%via NVD

CVE-2021-36373Medium· 5.5

5y ago

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Ap…

▾ Sunlitapache · antEPSS 2.5%via NVD

CVE-2020-36183High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

▾ Twilightfasterxml · jackson-databindEPSS 4.9%via NVD

CVE-2020-36182High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

▾ Twilightfasterxml · jackson-databindEPSS 5.0%via NVD

CVE-2020-36180High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

▾ Midnightnetapp · cloud_backupEPSS 5.0%via NVD

CVE-2020-36179High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

▾ Midnightnetapp · cloud_backupEPSS 21%via NVD

CVE-2020-36189High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

▾ Twilightfasterxml · jackson-databindEPSS 4.9%via NVD

CVE-2020-36188High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

▾ Midnightfasterxml · jackson-databindEPSS 11%via NVD

CVE-2020-36187High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 5.2%via NVD

CVE-2020-36186High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 5.2%via NVD

CVE-2020-36185High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 5.2%via NVD

CVE-2020-36184High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

▾ Midnightnetapp · cloud_backupEPSS 10%via NVD

CVE-2020-36181High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

▾ Twilightnetapp · service_level_managerEPSS 5.0%via NVD

CVE-2020-35728High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/jav…

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/jav…

▾ Midnightfasterxml · jackson-databindEPSS 13%via NVD

CVE-2020-17521Medium· 5.5

5y ago

Apache Groovy provides extension methods to aid with creating temporary directories

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on …

▾ Sunlitapache · groovyEPSS 1.1%via NVD

CVE-2020-25649High· 7.5

5y ago

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

▾ Twilightfasterxml · jackson-databindEPSS 18%via NVD

CVE-2019-10086High· 7.3

7y ago

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using…

▾ Twilightapache · commons_beanutilsEPSS 29%via NVD

CVE-2018-15756High· 7.5

7y ago

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRe…

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRe…

▾ Twilightvmware · spring_frameworkEPSS 9.2%via NVD