ByteOS

cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*

>>autovue_for_agile_product_lifecycle_management>>21.0.2

cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*

>>banking_platform>>Versions from 2.4.0(inclusive) to 2.9.0(inclusive)

cpe:2.3:a:oracle:communications_contacts_server:8.0.0.4.0:*:*:*:*:*:*:*

>>communications_contacts_server>>8.0.0.4.0

cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*

>>communications_evolved_communications_application_server>>7.1

cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*

>>communications_instant_messaging_server>>10.0.1.4.0

cpe:2.3:a:oracle:communications_network_charging_and_control:*:*:*:*:*:*:*:*

>>communications_network_charging_and_control>>Versions from 12.0.0(inclusive) to 12.0.3(inclusive)

cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*

>>communications_network_charging_and_control>>6.0.1

cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*

>>enterprise_manager_base_platform>>13.3.0.0

cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*

>>enterprise_manager_base_platform>>13.4.0.0

cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*

>>global_lifecycle_management_opatch>>Versions before 12.2.0.1.20(exclusive)

cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*

>>jd_edwards_enterpriseone_orchestrator>>Versions before 9.2.4.2(exclusive)

cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*

>>jd_edwards_enterpriseone_tools>>Versions before 9.2.4.2(exclusive)

cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*

>>primavera_unifier>>Versions from 17.7(inclusive) to 17.12(inclusive)

cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*

>>primavera_unifier>>16.1

cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*

>>primavera_unifier>>16.2

cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*

>>primavera_unifier>>18.8

cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*

>>primavera_unifier>>19.12

cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*

>>retail_xstore_point_of_service>>15.0

cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*

>>retail_xstore_point_of_service>>16.0

cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*

>>retail_xstore_point_of_service>>17.0

cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:*

>>retail_xstore_point_of_service>>18.0

cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0:*:*:*:*:*:*:*

>>retail_xstore_point_of_service>>19.0

cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*

>>weblogic_server>>12.2.1.3.0

cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*

>>weblogic_server>>12.2.1.4.0

Weaknesses

CWE ID	Type	Source
CWE-502	Primary	nvd@nist.gov

CWE ID: CWE-502

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/FasterXML/jackson-databind/issues/2634	cve@mitre.org	Patch Third Party Advisory
https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1%40%3Cnotifications.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a%40%3Cnotifications.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6%40%3Cnotifications.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab%40%3Cnotifications.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc%40%3Cdev.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428%40%3Cnotifications.zookeeper.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E	cve@mitre.org	N/A
https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html	cve@mitre.org	Mailing List Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062	cve@mitre.org	N/A
https://security.netapp.com/advisory/ntap-20200904-0006/	cve@mitre.org	Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html	cve@mitre.org	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html	cve@mitre.org	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html	cve@mitre.org	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html	cve@mitre.org	Patch Third Party Advisory

Hyperlink: https://github.com/FasterXML/jackson-databind/issues/2634

Source: cve@mitre.org

Resource:

Patch

Third Party Advisory

Hyperlink: https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1%40%3Cnotifications.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a%40%3Cnotifications.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6%40%3Cnotifications.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab%40%3Cnotifications.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc%40%3Cdev.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428%40%3Cnotifications.zookeeper.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html

Source: cve@mitre.org

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://security.netapp.com/advisory/ntap-20200904-0006/

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpujan2021.html

Source: cve@mitre.org

Resource:

Patch

Third Party Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpujul2020.html

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2020.html

Source: cve@mitre.org

Resource:

Patch

Third Party Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2021.html

Source: cve@mitre.org

Resource:

Patch

Third Party Advisory

Similar CVEs

3035Records found

CVE-2018-1000888

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-20.28% / 95.30%

7 Day CHG~0.00%

Published-27 Dec, 2018 | 18:00

Updated-05 Aug, 2024 | 12:47

PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called without a specific prefix path, we can trigger unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path. Object injection can be used to trigger destruct in the loaded PHP classes, e.g. the Archive_Tar class itself. With Archive_Tar object injection, arbitrary file deletion can occur because `@unlink($this->_temp_tarname)` is called. If another class with useful gadget is loaded, it may possible to cause remote code execution that can result in files being deleted or possibly modified. This vulnerability appears to have been fixed in 1.4.4.

Vendor-n/a Canonical Ltd.The PHP Group Debian GNU/Linux

Product-ubuntu_linux debian_linux pear_archive_tar n/a

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2017-9805

Matching Score-10

Matching Score-10

Product-struts oncommand_balance digital_media_manager video_distribution_suite_for_internet_streaming hosted_collaboration_solution network_performance_analysis media_experience_engine Apache Struts Struts

CVSS Score-8.1||HIGH

EPSS-94.39% / 99.97%

7 Day CHG~0.00%

Published-15 Sep, 2017 | 19:00

Updated-30 Jul, 2025 | 01:46

Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Vendor-Cisco Systems, Inc.NetApp, Inc.The Apache Software Foundation

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-9548

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-69.81% / 98.60%

7 Day CHG~0.00%

Published-02 Mar, 2020 | 03:58

Updated-04 Aug, 2024 | 10:34

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2017-8829

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.31% / 53.44%

7 Day CHG~0.00%

Published-08 May, 2017 | 06:10

Updated-20 Apr, 2025 | 01:37

Deserialization vulnerability in lintian through 2.5.50.3 allows attackers to trigger code execution by requesting a review of a source package with a crafted YAML file.

Vendor-n/a Debian GNU/Linux

Product-lintian n/a

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2017-7525

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-9.8||CRITICAL

EPSS-77.65% / 98.95%

7 Day CHG~0.00%

Published-06 Feb, 2018 | 15:00

Updated-17 Sep, 2024 | 02:21

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

CWE ID-CWE-184

Incomplete List of Disallowed Inputs

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-9546

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-2.33% / 84.18%

7 Day CHG~0.00%

Published-02 Mar, 2020 | 03:59

Updated-04 Aug, 2024 | 10:34

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-8165

Matching Score-10

Assigner-HackerOne

Matching Score-10

Assigner-HackerOne

CVSS Score-9.8||CRITICAL

EPSS-90.96% / 99.62%

7 Day CHG~0.00%

Published-19 Jun, 2020 | 17:05

Updated-09 May, 2025 | 20:15

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

Vendor-n/a Debian GNU/Linux Ruby on Rails openSUSE

Product-debian_linux rails leap https://github.com/rails/rails

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-8840

Matching Score-10

Assigner-MITRE Corporation

Vendor-n/a Debian GNU/Linux Oracle Corporation Huawei Technologies Co., Ltd.FasterXML, LLC.NetApp, Inc.

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-8.16% / 91.83%

7 Day CHG~0.00%

Published-10 Feb, 2020 | 19:41

Updated-04 Aug, 2024 | 10:12

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Product-global_lifecycle_management_opatch debian_linux oncommand_api_services jackson-databind oceanstor_9000_firmware oceanstor_9000 oncommand_workflow_automation service_level_manager steelstore_cloud_integrated_storage n/a

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-5413

Matching Score-10

Assigner-VMware by Broadcom

Product-banking_supply_chain_finance flexcube_private_banking spring_integration banking_corporate_lending_process_management banking_credit_facilities_process_management retail_merchandising_system banking_virtual_account_management retail_customer_management_and_segmentation_foundation Spring Integration

Matching Score-10

Assigner-VMware by Broadcom

CVSS Score-9.8||CRITICAL

EPSS-2.18% / 83.66%

7 Day CHG~0.00%

Published-31 Jul, 2020 | 19:40

Updated-16 Sep, 2024 | 16:22

Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"

Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.

Vendor-Oracle Corporation VMware (Broadcom Inc.)

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2017-17485

Matching Score-10

Assigner-MITRE Corporation

Product-enterprise_linux_server debian_linux jackson-databind openshift_container_platform e-series_santricity_os_controller e-series_santricity_web_services_proxy oncommand_shift jboss_enterprise_application_platform snapcenter n/a

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-76.42% / 98.89%

7 Day CHG~0.00%

Published-10 Jan, 2018 | 18:00

Updated-01 May, 2025 | 03:55

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

Vendor-n/a NetApp, Inc.Debian GNU/Linux FasterXML, LLC.Red Hat, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-36183

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-2.42% / 84.50%

7 Day CHG~0.00%

Published-06 Jan, 2021 | 22:30

Updated-04 Aug, 2024 | 17:23

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2017-5645

Matching Score-10

Matching Score-10

Product-flexcube_investor_servicing enterprise_linux_desktop instantis_enterprisetrack financial_services_profitability_management peoplesoft_enterprise_fin_install siebel_ui_framework mysql_enterprise_monitor communications_online_mediation_controller oncommand_insight rapid_planning oncommand_api_services financial_services_loan_loss_forecasting_and_provisioning retail_service_backbone insurance_rules_palette application_testing_suite communications_pricing_design_center communications_messaging_server enterprise_manager_base_platform endeca_information_discovery_studio retail_extract_transform_and_load financial_services_behavior_detection_platform insurance_calculation_engine jdeveloper enterprise_linux_server_tus policy_automation_connector_for_siebel fusion_middleware_mapviewer enterprise_manager_for_fusion_middleware primavera_gateway financial_services_hedge_management_and_ifrs_valuations utilities_advanced_spatial_and_operational_analytics enterprise_linux_server_aus banking_platform retail_integration_bus configuration_manager snapcenter enterprise_manager_for_peoplesoft utilities_work_and_asset_management financial_services_analytical_applications_infrastructure retail_advanced_inventory_planning goldengate policy_automation financial_services_regulatory_reporting_with_agilereporter jd_edwards_enterpriseone_tools storage_automation_store retail_predictive_application_server communications_network_integrity enterprise_manager_for_mysql_database api_gateway enterprise_linux_server_eus enterprise_linux tape_library_acsls policy_automation_for_mobile_devices soa_suite retail_open_commerce_platform identity_manager_connector bi_publisher insurance_policy_administration communications_webrtc_session_controller weblogic_server identity_analytics communications_converged_application_server_-_service_controller enterprise_linux_workstation identity_management_suite enterprise_linux_server timesten_in-memory_database log4j communications_instant_messaging_server service_level_manager autovue_vuelink_integration enterprise_manager_for_oracle_database fuse retail_clearance_optimization_engine communications_service_broker communications_interactive_session_recorder financial_services_lending_and_leasing oncommand_workflow_automation enterprise_data_quality goldengate_application_adapters in-memory_performance-driven_planning Apache Log4j

CVSS Score-9.8||CRITICAL

EPSS-94.01% / 99.88%

7 Day CHG+0.10%

Published-17 Apr, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Vendor-Red Hat, Inc.The Apache Software Foundation Oracle Corporation NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-36181

Matching Score-10

Assigner-MITRE Corporation

Product-primavera_unifier jd_edwards_enterpriseone_orchestrator primavera_gateway communications_network_charging_and_control communications_session_route_manager retail_service_backbone communications_session_report_manager communications_instant_messaging_server autovue_for_agile_product_lifecycle_management agile_plm communications_policy_management communications_cloud_native_core_policy retail_merchandising_system communications_convergent_charging_controller commerce_platform blockchain_platform communications_cloud_native_core_unified_data_repository jackson-databind communications_evolved_communications_application_server communications_unified_inventory_management service_level_manager documaker application_testing_suite communications_services_gatekeeper banking_virtual_account_management retail_customer_management_and_segmentation_foundation insurance_rules_palette communications_billing_and_revenue_management communications_offline_mediation_controller debian_linux banking_supply_chain_finance communications_diameter_signaling_route communications_pricing_design_center banking_credit_facilities_process_management retail_xstore_point_of_service insurance_policy_administration banking_corporate_lending_process_management goldengate_application_adapters banking_extensibility_workbench communications_element_manager jd_edwards_enterpriseone_tools banking_treasury_management webcenter_portal data_integrator n/a communications_diameter_signaling_router global_lifecycle_management_opatch retail_sales_audit primavera_unifier banking_digital_experience jd_edwards_enterpriseone_orchestrator retail_service_backbone communications_network_charging_and_control communications_session_route_manager communications_instant_messaging_server autovue_for_agile_product_lifecycle_management agile_plm financial_services_retail_customer_analytics financial_services_price_creation_and_discovery retail_merchandising_system financial_services_institutional_performance_analytics steelstore_cloud_integrated_storage debian_linux insurance_policy_administration_j2ee weblogic_server jackson-databind financial_services_analytical_applications_infrastructure communications_calendar_server retail_xstore_point_of_service communications_evolved_communications_application_server communications_element_manager enterprise_manager_base_platform

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-6.31% / 90.57%

7 Day CHG~0.00%

Published-06 Jan, 2021 | 22:29

Updated-04 Aug, 2024 | 17:23

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-36184

Matching Score-10

Assigner-MITRE Corporation

Product-primavera_unifier cloud_backup jd_edwards_enterpriseone_orchestrator primavera_gateway communications_network_charging_and_control communications_session_route_manager retail_service_backbone communications_session_report_manager communications_instant_messaging_server autovue_for_agile_product_lifecycle_management agile_plm communications_policy_management communications_cloud_native_core_policy retail_merchandising_system communications_convergent_charging_controller commerce_platform blockchain_platform communications_cloud_native_core_unified_data_repository jackson-databind communications_evolved_communications_application_server communications_unified_inventory_management service_level_manager documaker application_testing_suite communications_services_gatekeeper banking_virtual_account_management retail_customer_management_and_segmentation_foundation insurance_rules_palette communications_billing_and_revenue_management communications_offline_mediation_controller debian_linux banking_supply_chain_finance communications_diameter_signaling_route communications_pricing_design_center banking_credit_facilities_process_management retail_xstore_point_of_service insurance_policy_administration banking_corporate_lending_process_management goldengate_application_adapters banking_extensibility_workbench communications_element_manager jd_edwards_enterpriseone_tools banking_treasury_management webcenter_portal data_integrator n/a communications_diameter_signaling_router global_lifecycle_management_opatch retail_sales_audit primavera_unifier banking_digital_experience jd_edwards_enterpriseone_orchestrator retail_service_backbone communications_network_charging_and_control communications_session_route_manager communications_instant_messaging_server agile_plm autovue_for_agile_product_lifecycle_management financial_services_retail_customer_analytics financial_services_price_creation_and_discovery retail_merchandising_system financial_services_institutional_performance_analytics steelstore_cloud_integrated_storage debian_linux insurance_policy_administration_j2ee weblogic_server jackson-databind financial_services_analytical_applications_infrastructure communications_calendar_server retail_xstore_point_of_service communications_evolved_communications_application_server communications_element_manager enterprise_manager_base_platform

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-5.06% / 89.37%

7 Day CHG~0.00%

Published-06 Jan, 2021 | 22:30

Updated-04 Aug, 2024 | 17:23

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-36187

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-2.04% / 83.09%

7 Day CHG~0.00%

Published-06 Jan, 2021 | 22:29

Updated-04 Aug, 2024 | 17:23

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-36186

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-2.21% / 83.78%

7 Day CHG~0.00%

Published-06 Jan, 2021 | 22:29

Updated-04 Aug, 2024 | 17:23

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-36179

Matching Score-10

Assigner-MITRE Corporation

Product-primavera_unifier cloud_backup jd_edwards_enterpriseone_orchestrator primavera_gateway communications_network_charging_and_control communications_session_route_manager retail_service_backbone communications_session_report_manager communications_instant_messaging_server autovue_for_agile_product_lifecycle_management agile_plm communications_policy_management communications_cloud_native_core_policy retail_merchandising_system communications_convergent_charging_controller commerce_platform blockchain_platform communications_cloud_native_core_unified_data_repository jackson-databind communications_evolved_communications_application_server communications_unified_inventory_management service_level_manager application_testing_suite communications_services_gatekeeper banking_virtual_account_management retail_customer_management_and_segmentation_foundation insurance_rules_palette communications_billing_and_revenue_management communications_offline_mediation_controller debian_linux banking_supply_chain_finance communications_diameter_signaling_route communications_pricing_design_center retail_xstore_point_of_service insurance_policy_administration banking_corporate_lending_process_management goldengate_application_adapters banking_credit_facilities_process_management communications_element_manager jd_edwards_enterpriseone_tools banking_treasury_management webcenter_portal data_integrator n/a communications_diameter_signaling_router global_lifecycle_management_opatch retail_sales_audit primavera_unifier banking_digital_experience jd_edwards_enterpriseone_orchestrator retail_service_backbone communications_network_charging_and_control communications_session_route_manager communications_instant_messaging_server agile_plm autovue_for_agile_product_lifecycle_management financial_services_retail_customer_analytics financial_services_price_creation_and_discovery retail_merchandising_system financial_services_institutional_performance_analytics steelstore_cloud_integrated_storage debian_linux insurance_policy_administration_j2ee weblogic_server jackson-databind financial_services_analytical_applications_infrastructure communications_calendar_server retail_xstore_point_of_service communications_evolved_communications_application_server communications_element_manager enterprise_manager_base_platform

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-61.30% / 98.25%

7 Day CHG~0.00%

Published-06 Jan, 2021 | 22:30

Updated-04 Aug, 2024 | 17:23

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-35728

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-39.67% / 97.21%

7 Day CHG~0.00%

Published-27 Dec, 2020 | 04:32

Updated-01 May, 2025 | 03:55

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Vendor-n/a NetApp, Inc.Oracle Corporation FasterXML, LLC.Debian GNU/Linux

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-36180

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-1.96% / 82.72%

7 Day CHG~0.00%

Published-06 Jan, 2021 | 22:30

Updated-04 Aug, 2024 | 17:23

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-36182

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-2.12% / 83.43%

7 Day CHG~0.00%

Published-06 Jan, 2021 | 22:30

Updated-04 Aug, 2024 | 17:23

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-36188

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-6.98% / 91.06%

7 Day CHG~0.00%

Published-06 Jan, 2021 | 22:29

Updated-04 Aug, 2024 | 17:23

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-36189

Matching Score-10

Assigner-MITRE Corporation

Product-communications_diameter_signaling_router primavera_unifier cloud_backup jd_edwards_enterpriseone_orchestrator primavera_gateway communications_network_charging_and_control communications_session_route_manager retail_service_backbone banking_platform communications_instant_messaging_server autovue_for_agile_product_lifecycle_management agile_plm retail_merchandising_system communications_cloud_native_core_policy communications_convergent_charging_controller commerce_platform blockchain_platform communications_cloud_native_core_unified_data_repository jackson-databind communications_evolved_communications_application_server communications_interactive_session_recorder communications_unified_inventory_management service_level_manager documaker application_testing_suite communications_services_gatekeeper banking_virtual_account_management retail_customer_management_and_segmentation_foundation insurance_rules_palette communications_billing_and_revenue_management communications_messaging_server communications_offline_mediation_controller debian_linux communications_pricing_design_center retail_xstore_point_of_service insurance_policy_administration goldengate_application_adapters jd_edwards_enterpriseone_tools banking_treasury_management webcenter_portal n/a

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-2.86% / 85.72%

7 Day CHG~0.00%

Published-06 Jan, 2021 | 22:29

Updated-04 Aug, 2024 | 17:23

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-35490

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-4.75% / 89.00%

7 Day CHG~0.00%

Published-17 Dec, 2020 | 18:43

Updated-04 Aug, 2024 | 17:02

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2025-36038

Matching Score-10

Assigner-IBM Corporation

Vendor-IBM Corporation HP Inc.Microsoft Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-9||CRITICAL

EPSS-0.19% / 40.66%

7 Day CHG~0.00%

Published-25 Jun, 2025 | 20:38

Updated-26 Aug, 2025 | 14:51

IBM WebSphere Application Server code execution

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.

Product-linux_kernel windows websphere_application_server aix solaris hp-ux i z\/os WebSphere Application Server

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-28032

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-47.66% / 97.62%

7 Day CHG~0.00%

Published-31 Oct, 2020 | 00:59

Updated-04 Aug, 2024 | 16:33

WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.

Vendor-n/a Debian GNU/Linux WordPress.org Fedora Project

Product-wordpress debian_linux fedora n/a

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-28948

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-70.34% / 98.62%

7 Day CHG~0.00%

Published-19 Nov, 2020 | 18:14

Updated-04 Aug, 2024 | 16:48

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

Vendor-n/a Debian GNU/Linux Fedora Project The PHP Group The Drupal Association

Product-debian_linux fedora drupal archive_tar n/a

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-24750

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-2.11% / 83.38%

7 Day CHG~0.00%

Published-17 Sep, 2020 | 18:39

Updated-04 Aug, 2024 | 15:19

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-14061

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-6.15% / 90.45%

7 Day CHG~0.00%

Published-14 Jun, 2020 | 19:42

Updated-01 May, 2025 | 03:55

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-14195

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-9.51% / 92.52%

7 Day CHG~0.00%

Published-16 Jun, 2020 | 15:07

Updated-04 Aug, 2024 | 12:39

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2015-4852

Matching Score-10

Assigner-Oracle

Matching Score-10

Assigner-Oracle

CVSS Score-9.8||CRITICAL

EPSS-92.69% / 99.74%

7 Day CHG~0.00%

Published-18 Nov, 2015 | 15:00

Updated-30 Jul, 2025 | 01:46

Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

Vendor-n/a Oracle Corporation

Product-virtual_desktop_infrastructure storagetek_tape_analytics_sw_tool weblogic_server n/a WebLogic Server

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-11973

Matching Score-10

Matching Score-10

Product-communications_diameter_signaling_router camel enterprise_manager_base_platform flexcube_private_banking Apache Camel

CVSS Score-9.8||CRITICAL

EPSS-9.48% / 92.51%

7 Day CHG~0.00%

Published-14 May, 2020 | 16:22

Updated-04 Aug, 2024 | 11:48

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Vendor-n/a The Apache Software Foundation Oracle Corporation

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-11972

Matching Score-10

Matching Score-10

Product-communications_diameter_signaling_router camel enterprise_manager_base_platform flexcube_private_banking Apache Camel

CVSS Score-9.8||CRITICAL

EPSS-8.39% / 91.94%

7 Day CHG~0.00%

Published-14 May, 2020 | 16:26

Updated-04 Aug, 2024 | 11:48

Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Vendor-n/a The Apache Software Foundation Oracle Corporation

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-11619

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-1.83% / 82.14%

7 Day CHG~0.00%

Published-07 Apr, 2020 | 22:14

Updated-04 Aug, 2024 | 11:35

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-11620

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-2.24% / 83.89%

7 Day CHG~0.00%

Published-07 Apr, 2020 | 22:14

Updated-04 Aug, 2024 | 11:35

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-11112

Matching Score-10

Assigner-MITRE Corporation

Product-communications_diameter_signaling_router global_lifecycle_management_opatch retail_sales_audit communications_contacts_server primavera_unifier banking_digital_experience jd_edwards_enterpriseone_orchestrator retail_service_backbone communications_network_charging_and_control communications_session_route_manager banking_platform communications_session_report_manager communications_instant_messaging_server agile_plm autovue_for_agile_product_lifecycle_management financial_services_retail_customer_analytics financial_services_price_creation_and_discovery retail_merchandising_system financial_services_institutional_performance_analytics steelstore_cloud_integrated_storage debian_linux insurance_policy_administration_j2ee weblogic_server jackson-databind financial_services_analytical_applications_infrastructure communications_calendar_server retail_xstore_point_of_service communications_evolved_communications_application_server communications_element_manager jd_edwards_enterpriseone_tools enterprise_manager_base_platform n/a communications_diameter_signaling_router global_lifecycle_management_opatch retail_sales_audit primavera_unifier banking_digital_experience jd_edwards_enterpriseone_orchestrator retail_service_backbone communications_network_charging_and_control communications_session_route_manager communications_instant_messaging_server agile_plm autovue_for_agile_product_lifecycle_management financial_services_retail_customer_analytics financial_services_price_creation_and_discovery retail_merchandising_system financial_services_institutional_performance_analytics steelstore_cloud_integrated_storage debian_linux insurance_policy_administration_j2ee weblogic_server jackson-databind financial_services_analytical_applications_infrastructure communications_calendar_server retail_xstore_point_of_service communications_evolved_communications_application_server communications_element_manager enterprise_manager_base_platform

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-11.42% / 93.31%

7 Day CHG~0.00%

Published-31 Mar, 2020 | 04:37

Updated-04 Aug, 2024 | 11:21

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-11111

Matching Score-10

Assigner-MITRE Corporation

Product-communications_diameter_signaling_router global_lifecycle_management_opatch retail_sales_audit communications_contacts_server primavera_unifier banking_digital_experience jd_edwards_enterpriseone_orchestrator communications_network_charging_and_control communications_session_route_manager banking_platform communications_session_report_manager communications_instant_messaging_server agile_plm autovue_for_agile_product_lifecycle_management retail_merchandising_system steelstore_cloud_integrated_storage debian_linux weblogic_server jackson-databind communications_calendar_server retail_xstore_point_of_service communications_evolved_communications_application_server communications_element_manager jd_edwards_enterpriseone_tools enterprise_manager_base_platform n/a communications_diameter_signaling_router global_lifecycle_management_opatch retail_sales_audit primavera_unifier banking_digital_experience jd_edwards_enterpriseone_orchestrator retail_service_backbone communications_network_charging_and_control communications_session_route_manager communications_instant_messaging_server autovue_for_agile_product_lifecycle_management agile_plm financial_services_retail_customer_analytics financial_services_price_creation_and_discovery retail_merchandising_system financial_services_institutional_performance_analytics steelstore_cloud_integrated_storage debian_linux insurance_policy_administration_j2ee weblogic_server jackson-databind financial_services_analytical_applications_infrastructure communications_calendar_server retail_xstore_point_of_service communications_evolved_communications_application_server communications_element_manager enterprise_manager_base_platform

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-2.20% / 83.73%

7 Day CHG~0.00%

Published-31 Mar, 2020 | 04:37

Updated-04 Aug, 2024 | 11:21

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-10673

Matching Score-10

Assigner-MITRE Corporation

Product-communications_diameter_signaling_router global_lifecycle_management_opatch retail_sales_audit communications_contacts_server primavera_unifier banking_digital_experience jd_edwards_enterpriseone_orchestrator retail_service_backbone communications_network_charging_and_control communications_session_route_manager banking_platform communications_session_report_manager communications_instant_messaging_server agile_plm autovue_for_agile_product_lifecycle_management financial_services_retail_customer_analytics financial_services_price_creation_and_discovery retail_merchandising_system financial_services_institutional_performance_analytics steelstore_cloud_integrated_storage debian_linux insurance_policy_administration_j2ee weblogic_server jackson-databind financial_services_analytical_applications_infrastructure communications_calendar_server retail_xstore_point_of_service communications_evolved_communications_application_server communications_element_manager jd_edwards_enterpriseone_tools enterprise_manager_base_platform n/a autovue_for_agile_product_lifecycle_management global_lifecycle_management_opatch communications_evolved_communications_application_server communications_network_charging_and_control enterprise_manager_base_platform financial_services_price_creation_and_discovery weblogic_server communications_element_manager retail_service_backbone jackson-databind primavera_unifier debian_linux steelstore_cloud_integrated_storage agile_plm communications_diameter_signaling_router banking_digital_experience financial_services_analytical_applications_infrastructure jd_edwards_enterpriseone_orchestrator communications_session_route_manager financial_services_retail_customer_analytics retail_sales_audit insurance_policy_administration_j2ee communications_calendar_server communications_instant_messaging_server financial_services_institutional_performance_analytics retail_merchandising_system retail_xstore_point_of_service

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-20.47% / 95.33%

7 Day CHG~0.00%

Published-18 Mar, 2020 | 21:17

Updated-01 May, 2025 | 03:55

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

Vendor-n/a Oracle Corporation Debian GNU/Linux NetApp, Inc.FasterXML, LLC.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-10968

Matching Score-10

Assigner-MITRE Corporation

Product-communications_diameter_signaling_router global_lifecycle_management_opatch retail_sales_audit communications_contacts_server primavera_unifier banking_digital_experience jd_edwards_enterpriseone_orchestrator retail_service_backbone communications_network_charging_and_control communications_session_route_manager banking_platform communications_session_report_manager communications_instant_messaging_server agile_plm autovue_for_agile_product_lifecycle_management financial_services_retail_customer_analytics financial_services_price_creation_and_discovery retail_merchandising_system financial_services_institutional_performance_analytics steelstore_cloud_integrated_storage debian_linux insurance_policy_administration_j2ee weblogic_server jackson-databind financial_services_analytical_applications_infrastructure communications_calendar_server retail_xstore_point_of_service communications_evolved_communications_application_server communications_element_manager jd_edwards_enterpriseone_tools enterprise_manager_base_platform n/a communications_diameter_signaling_router global_lifecycle_management_opatch retail_sales_audit primavera_unifier banking_digital_experience jd_edwards_enterpriseone_orchestrator retail_service_backbone communications_network_charging_and_control communications_session_route_manager communications_instant_messaging_server autovue_for_agile_product_lifecycle_management agile_plm financial_services_retail_customer_analytics financial_services_price_creation_and_discovery retail_merchandising_system financial_services_institutional_performance_analytics steelstore_cloud_integrated_storage debian_linux insurance_policy_administration_j2ee weblogic_server jackson-databind financial_services_analytical_applications_infrastructure communications_calendar_server retail_xstore_point_of_service communications_evolved_communications_application_server communications_element_manager enterprise_manager_base_platform

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-6.63% / 90.81%

7 Day CHG~0.00%

Published-26 Mar, 2020 | 12:43

Updated-04 Aug, 2024 | 11:21

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-10969

Matching Score-10

Assigner-MITRE Corporation

Product-communications_diameter_signaling_router global_lifecycle_management_opatch retail_sales_audit communications_contacts_server primavera_unifier banking_digital_experience jd_edwards_enterpriseone_orchestrator retail_service_backbone communications_network_charging_and_control communications_session_route_manager banking_platform communications_session_report_manager communications_instant_messaging_server agile_plm autovue_for_agile_product_lifecycle_management financial_services_retail_customer_analytics financial_services_price_creation_and_discovery retail_merchandising_system financial_services_institutional_performance_analytics steelstore_cloud_integrated_storage debian_linux insurance_policy_administration_j2ee weblogic_server jackson-databind financial_services_analytical_applications_infrastructure communications_calendar_server retail_xstore_point_of_service communications_evolved_communications_application_server communications_element_manager jd_edwards_enterpriseone_tools enterprise_manager_base_platform n/a communications_diameter_signaling_router global_lifecycle_management_opatch retail_sales_audit primavera_unifier banking_digital_experience jd_edwards_enterpriseone_orchestrator retail_service_backbone communications_network_charging_and_control communications_session_route_manager communications_instant_messaging_server autovue_for_agile_product_lifecycle_management agile_plm financial_services_retail_customer_analytics financial_services_price_creation_and_discovery retail_merchandising_system financial_services_institutional_performance_analytics steelstore_cloud_integrated_storage debian_linux insurance_policy_administration_j2ee weblogic_server jackson-databind financial_services_analytical_applications_infrastructure communications_calendar_server retail_xstore_point_of_service communications_evolved_communications_application_server communications_element_manager enterprise_manager_base_platform

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-1.48% / 80.17%

7 Day CHG~0.00%

Published-26 Mar, 2020 | 12:43

Updated-04 Aug, 2024 | 11:21

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

Vendor-n/a Debian GNU/Linux Oracle Corporation FasterXML, LLC.NetApp, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-11113

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-61.75% / 98.27%

7 Day CHG~0.00%

Published-31 Mar, 2020 | 04:37

Updated-01 May, 2025 | 03:55

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

Vendor-n/a Oracle Corporation Debian GNU/Linux NetApp, Inc.FasterXML, LLC.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2025-24813

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-94.06% / 99.89%

7 Day CHG~0.00%

Published-10 Mar, 2025 | 16:44

Updated-08 Aug, 2025 | 17:56

Known KEV||Action Due Date - 2025-04-22||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Vendor-NetApp, Inc.The Apache Software Foundation Debian GNU/Linux

Product-bootstrap_os tomcat hci_compute_node debian_linux Apache Tomcat Tomcat

CWE ID-CWE-44

Path Equivalence: 'file.name' (Internal Dot)

CWE ID-CWE-502

Deserialization of Untrusted Data

CWE ID-CWE-706

Use of Incorrectly-Resolved Name or Reference

CVE-2023-28462

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.34% / 79.23%

7 Day CHG~0.00%

Published-30 Mar, 2023 | 00:00

Updated-18 Feb, 2025 | 19:15

A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server once a JNDI directory scan is performed.

Vendor-payara n/a Oracle Corporation

Product-jdk payara_server n/a

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2022-25845

Matching Score-10

Assigner-Snyk

Matching Score-10

Assigner-Snyk

CVSS Score-8.1||HIGH

EPSS-89.92% / 99.55%

7 Day CHG~0.00%

Published-10 Jun, 2022 | 20:05

Updated-16 Sep, 2024 | 23:36

Deserialization of Untrusted Data

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

Vendor-alibaba n/a Oracle Corporation

Product-fastjson communications_cloud_native_core_unified_data_repository com.alibaba:fastjson

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2021-42392

Matching Score-10

Assigner-JFrog

Matching Score-10

Assigner-JFrog

CVSS Score-9.8||CRITICAL

EPSS-91.68% / 99.67%

7 Day CHG~0.00%

Published-07 Jan, 2022 | 00:00

Updated-04 Aug, 2024 | 03:30

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.

Vendor-h2database h2database Oracle Corporation Debian GNU/Linux

Product-communications_cloud_native_core_policy debian_linux h2 h2

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2018-19296

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-1.23% / 78.31%

7 Day CHG~0.00%

Published-16 Nov, 2018 | 09:00

Updated-05 Aug, 2024 | 11:30

PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.

Vendor-phpmailer_project n/a Debian GNU/Linux WordPress.org Fedora Project

Product-debian_linux phpmailer wordpress fedora n/a

CWE ID-CWE-502

Deserialization of Untrusted Data

CWE ID-CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVE-2019-16943

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.89% / 82.43%

7 Day CHG~0.00%

Published-01 Oct, 2019 | 16:06

Updated-05 Aug, 2024 | 01:24

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

Vendor-n/a Debian GNU/Linux Fedora Project Oracle Corporation FasterXML, LLC.NetApp, Inc.Red Hat, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2019-17267

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.40% / 79.60%

7 Day CHG~0.00%

Published-06 Oct, 2019 | 23:08

Updated-05 Aug, 2024 | 01:33

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2019-17571

Matching Score-10

Matching Score-10

CVSS Score-9.8||CRITICAL

EPSS-54.03% / 97.92%

7 Day CHG~0.00%

Published-20 Dec, 2019 | 16:01

Updated-05 Aug, 2024 | 01:40

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2019-16942

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.44% / 62.17%

7 Day CHG~0.00%

Published-01 Oct, 2019 | 16:04

Updated-05 Aug, 2024 | 01:24

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

Vendor-n/a Debian GNU/Linux Fedora Project Oracle Corporation FasterXML, LLC.NetApp, Inc.Red Hat, Inc.

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2019-17570

Matching Score-10

Matching Score-10