communications_services_gatekeeper vulnerabilities

CVEs whose affected-version data names the communications_services_gatekeeper package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

27 CVEsRSS

CVE-2021-45105Medium· 5.90dayPoC

4y ago

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial …

▾ Midnightapache · log4jEPSS 100%via NVD

CVE-2021-2351High· 8.3

5y ago

Vulnerability in the Advanced Networking Option component of Oracle Database Server

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network acc…

▾ Twilightoracle · advanced_networking_optionEPSS 2.4%via NVD

CVE-2021-23337High· 7.2PoC

5y ago

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

▾ Midnightlodash · lodashEPSS 21%via NVD

CVE-2020-28500Medium· 5.3

5y ago

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

▾ Sunlitlodash · lodashEPSS 7.3%via NVD

CVE-2020-36183High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

▾ Twilightfasterxml · jackson-databindEPSS 5.0%via NVD

CVE-2020-36182High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

▾ Twilightfasterxml · jackson-databindEPSS 4.1%via NVD

CVE-2020-36180High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

▾ Midnightnetapp · cloud_backupEPSS 4.1%via NVD

CVE-2020-36179High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

▾ Midnightnetapp · cloud_backupEPSS 17%via NVD

CVE-2020-36189High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

▾ Twilightfasterxml · jackson-databindEPSS 4.0%via NVD

CVE-2020-36188High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

▾ Midnightfasterxml · jackson-databindEPSS 8.8%via NVD

CVE-2020-36187High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 4.2%via NVD

CVE-2020-36186High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 4.2%via NVD

CVE-2020-36185High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 4.2%via NVD

CVE-2020-36184High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

▾ Midnightnetapp · cloud_backupEPSS 8.4%via NVD

CVE-2020-36181High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

▾ Twilightnetapp · service_level_managerEPSS 4.1%via NVD

CVE-2020-35728High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/jav…

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/jav…

▾ Midnightfasterxml · jackson-databindEPSS 13%via NVD

CVE-2020-35491High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 7.8%via NVD

CVE-2020-35490High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 6.3%via NVD

CVE-2020-17521Medium· 5.5

5y ago

Apache Groovy provides extension methods to aid with creating temporary directories

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on …

▾ Sunlitapache · groovyEPSS 1.0%via NVD

CVE-2020-25649High· 7.5

5y ago

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

▾ Twilightfasterxml · jackson-databindEPSS 18%via NVD

CVE-2020-24750High· 8.1PoC

6y ago

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

▾ Midnightfasterxml · jackson-databindEPSS 7.3%via NVD

CVE-2020-24616High· 8.1PoC

6y ago

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

▾ Midnightfasterxml · jackson-databindEPSS 7.6%via NVD

CVE-2018-11040High· 7.5⚖ disputed

8y ago

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for R…

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for R…

▾ Twilightvmware · spring_frameworkEPSS 3.2%via NVD

CVE-2018-11039Medium· 5.9

8y ago

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilt…

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilt…

▾ Sunlitvmware · spring_frameworkEPSS 2.8%via NVD

CVE-2018-1257Medium· 6.5

8y ago

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messagi…

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messagi…

▾ Sunlitvmware · spring_frameworkEPSS 3.0%via NVD

CVE-2018-1258High· 8.8

8y ago

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should …

▾ Twilightpivotal_software · spring_securityEPSS 2.5%via NVD

CVE-2018-1270Critical· 9.8PoC

8y ago

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging…

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging…

▾ Abyssalvmware · spring_frameworkEPSS 77%via NVD