Max CVSS | 9.3 | Min CVSS | 4.3 | Total Count | 2 |
ID | CVSS | Summary | Last (major) update | Published | |
CVE-2018-8034 | 5.0 |
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
|
21-10-2024 - 16:35 | 01-08-2018 - 18:29 | |
CVE-2019-9514 | 7.8 |
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the p
|
19-10-2023 - 03:15 | 13-08-2019 - 21:15 | |
CVE-2017-15095 | 7.5 |
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMappe
|
13-09-2023 - 14:23 | 06-02-2018 - 15:29 | |
CVE-2018-14719 | 7.5 |
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
|
13-09-2023 - 14:22 | 02-01-2019 - 18:29 | |
CVE-2018-14718 | 7.5 |
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
|
13-09-2023 - 14:22 | 02-01-2019 - 18:29 | |
CVE-2018-12022 | 5.1 |
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in
|
13-09-2023 - 14:22 | 21-03-2019 - 16:00 | |
CVE-2017-17485 | 7.5 |
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to t
|
08-06-2023 - 18:00 | 10-01-2018 - 18:29 | |
CVE-2018-11307 | 7.5 |
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
|
08-06-2023 - 17:56 | 09-07-2019 - 16:15 | |
CVE-2019-10173 | 7.5 |
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshall
|
05-10-2022 - 20:38 | 23-07-2019 - 13:15 | |
CVE-2019-9512 | 7.8 |
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this d
|
12-08-2022 - 18:41 | 13-08-2019 - 21:15 | |
CVE-2019-9518 | 7.8 |
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONT
|
12-08-2022 - 18:40 | 13-08-2019 - 21:15 | |
CVE-2019-9515 | 7.8 |
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS f
|
12-08-2022 - 18:40 | 13-08-2019 - 21:15 | |
CVE-2019-0201 | 4.3 |
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field a
|
19-04-2022 - 15:35 | 23-05-2019 - 14:29 | |
CVE-2019-16869 | 5.0 |
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
|
30-03-2022 - 14:21 | 26-09-2019 - 16:15 | |
CVE-2019-0204 | 9.3 |
A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to
|
01-01-2022 - 20:16 | 25-03-2019 - 22:29 | |
CVE-2018-11775 | 5.8 |
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by def
|
05-03-2021 - 19:15 | 10-09-2018 - 20:29 | |
CVE-2018-12023 | 5.1 |
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provid
|
20-10-2020 - 22:15 | 21-03-2019 - 16:00 | |
CVE-2019-14860 | 4.3 |
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information.
|
09-10-2020 - 13:06 | 08-11-2019 - 15:15 | |
CVE-2018-8009 | 6.5 |
Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.
|
08-10-2020 - 10:15 | 13-11-2018 - 21:29 | |
CVE-2019-16869 | 5.0 |
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
|
25-09-2020 - 00:15 | 26-09-2019 - 16:15 | |
CVE-2018-19361 | 7.5 |
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
|
31-08-2020 - 14:15 | 02-01-2019 - 18:29 | |
CVE-2018-19360 | 7.5 |
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
|
31-08-2020 - 14:15 | 02-01-2019 - 18:29 | |
CVE-2018-19362 | 7.5 |
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
|
31-08-2020 - 14:15 | 02-01-2019 - 18:29 | |
CVE-2018-14721 | 7.5 |
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
|
31-08-2020 - 14:15 | 02-01-2019 - 18:29 | |
CVE-2018-14720 | 7.5 |
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
|
31-08-2020 - 14:15 | 02-01-2019 - 18:29 | |
CVE-2018-1000850 | 6.4 |
Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resou
|
17-10-2019 - 22:15 | 20-12-2018 - 15:29 | |
CVE-2018-1131 | 6.5 |
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types o
|
09-10-2019 - 23:38 | 15-05-2018 - 13:29 | |
CVE-2018-11796 | 5.0 |
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityMan
|
03-09-2019 - 18:15 | 09-10-2018 - 22:29 |