retail_service_backbone vulnerabilities

CVEs whose affected-version data names the retail_service_backbone package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

30 CVEsRSS

CVE-2022-23437Medium· 6.5

4y ago

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resourc…

▾ Sunlitapache · xerces-jEPSS 12%via NVD

CVE-2021-40690High· 7.5

5y ago

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allo…

▾ Twilightapache · santuario_xml_security_for_javaEPSS 7.4%via NVD

CVE-2021-36374Medium· 5.5

5y ago

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using…

▾ Sunlitapache · antEPSS 2.6%via NVD

CVE-2021-36373Medium· 5.5

5y ago

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Ap…

▾ Sunlitapache · antEPSS 2.5%via NVD

CVE-2020-36183High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

▾ Twilightfasterxml · jackson-databindEPSS 5.0%via NVD

CVE-2020-36182High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

▾ Twilightfasterxml · jackson-databindEPSS 4.1%via NVD

CVE-2020-36180High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

▾ Midnightnetapp · cloud_backupEPSS 4.1%via NVD

CVE-2020-36179High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

▾ Midnightnetapp · cloud_backupEPSS 17%via NVD

CVE-2020-36189High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

▾ Twilightfasterxml · jackson-databindEPSS 4.0%via NVD

CVE-2020-36188High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

▾ Midnightfasterxml · jackson-databindEPSS 8.8%via NVD

CVE-2020-36187High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 4.2%via NVD

CVE-2020-36186High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 4.2%via NVD

CVE-2020-36185High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

▾ Twilightfasterxml · jackson-databindEPSS 4.2%via NVD

CVE-2020-36184High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

▾ Midnightnetapp · cloud_backupEPSS 8.4%via NVD

CVE-2020-36181High· 8.1

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

▾ Twilightnetapp · service_level_managerEPSS 4.1%via NVD

CVE-2020-35728High· 8.1PoC

5y ago

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/jav…

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/jav…

▾ Midnightfasterxml · jackson-databindEPSS 13%via NVD

CVE-2020-25649High· 7.5

5y ago

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

▾ Twilightfasterxml · jackson-databindEPSS 18%via NVD

CVE-2020-11979High· 7.5

6y ago

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new…

▾ Twilightapache · antEPSS 7.8%via NVD

CVE-2020-5421Medium· 6.5PoC⚖ disputed

6y ago

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the …

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the …

▾ Twilightvmware · spring_frameworkEPSS 12%via NVD

CVE-2020-11113High· 8.8PoC

6y ago

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

▾ Midnightfasterxml · jackson-databindEPSS 6.3%via NVD

CVE-2020-11112High· 8.8

6y ago

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

▾ Twilightfasterxml · jackson-databindEPSS 3.6%via NVD

CVE-2020-10969High· 8.8

6y ago

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

▾ Twilightfasterxml · jackson-databindEPSS 3.6%via NVD

CVE-2020-10968High· 8.8

6y ago

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

▾ Twilightfasterxml · jackson-databindEPSS 3.7%via NVD

CVE-2020-10673High· 8.8PoC

6y ago

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

▾ Midnightfasterxml · jackson-databindEPSS 8.0%via NVD

CVE-2020-10672High· 8.8

6y ago

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

▾ Twilightfasterxml · jackson-databindEPSS 3.1%via NVD

CVE-2020-9546Critical· 9.8

6y ago

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

▾ Midnightfasterxml · jackson-databindEPSS 4.6%via NVD

CVE-2020-5398High· 7.5PoC

6y ago

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in…

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in…

▾ Midnightvmware · spring_frameworkEPSS 88%via NVD

CVE-2019-3740Medium· 6.5

7y ago

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to rec…

▾ Sunlitdell · bsafe_cert-jEPSS 3.9%via NVD

CVE-2019-3739Medium· 6.5

7y ago

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to reco…

▾ Sunlitdell · bsafe_cert-jEPSS 2.6%via NVD

CVE-2018-11040High· 7.5⚖ disputed

8y ago

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for R…

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for R…

▾ Twilightvmware · spring_frameworkEPSS 3.2%via NVD