|
2017-04-17
|
CVE-2017-5645
|
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
|
Log4j, Oncommand_api_services, Oncommand_insight, Oncommand_workflow_automation, Service_level_manager, Snapcenter, Storage_automation_store, Api_gateway, Application_testing_suite, Autovue_vuelink_integration, Banking_platform, Bi_publisher, Communications_converged_application_server_\-_service_controller, Communications_instant_messaging_server, Communications_interactive_session_recorder, Communications_messaging_server, Communications_network_integrity, Communications_online_mediation_controller, Communications_pricing_design_center, Communications_service_broker, Communications_webrtc_session_controller, Configuration_manager, Endeca_information_discovery_studio, Enterprise_data_quality, Enterprise_manager_base_platform, Enterprise_manager_for_fusion_middleware, Enterprise_manager_for_mysql_database, Enterprise_manager_for_oracle_database, Enterprise_manager_for_peoplesoft, Financial_services_analytical_applications_infrastructure, Financial_services_behavior_detection_platform, Financial_services_hedge_management_and_ifrs_valuations, Financial_services_lending_and_leasing, Financial_services_loan_loss_forecasting_and_provisioning, Financial_services_profitability_management, Financial_services_regulatory_reporting_with_agilereporter, Flexcube_investor_servicing, Fusion_middleware_mapviewer, Goldengate, Goldengate_application_adapters, Identity_analytics, Identity_management_suite, Identity_manager_connector, In\-Memory_performance\-Driven_planning, Instantis_enterprisetrack, Insurance_calculation_engine, Insurance_policy_administration, Insurance_rules_palette, Jd_edwards_enterpriseone_tools, Jdeveloper, Mysql_enterprise_monitor, Peoplesoft_enterprise_fin_install, Policy_automation, Policy_automation_connector_for_siebel, Policy_automation_for_mobile_devices, Primavera_gateway, Rapid_planning, Retail_advanced_inventory_planning, Retail_clearance_optimization_engine, Retail_extract_transform_and_load, Retail_integration_bus, Retail_open_commerce_platform, Retail_predictive_application_server, Retail_service_backbone, Siebel_ui_framework, Soa_suite, Tape_library_acsls, Timesten_in\-Memory_database, Utilities_advanced_spatial_and_operational_analytics, Utilities_work_and_asset_management, Weblogic_server, Enterprise_linux, Enterprise_linux_desktop, Enterprise_linux_server, Enterprise_linux_server_aus, Enterprise_linux_server_eus, Enterprise_linux_server_tus, Enterprise_linux_workstation, Fuse
|
9.8
|
|
|
|
2018-10-18
|
CVE-2018-15756
|
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of...
|
Debian_linux, Agile_plm, Communications_brm_\-_elastic_charging_engine, Communications_converged_application_server_\-_service_controller, Communications_diameter_signaling_router, Communications_element_manager, Communications_online_mediation_controller, Communications_session_report_manager, Communications_session_route_manager, Communications_unified_inventory_management, Endeca_information_discovery_integrator, Enterprise_manager_for_fusion_applications, Enterprise_manager_ops_center, Financial_services_analytical_applications_infrastructure, Flexcube_private_banking, Goldengate_application_adapters, Healthcare_master_person_index, Identity_manager_connector, Insurance_calculation_engine, Insurance_policy_administration_j2ee, Insurance_rules_palette, Mysql_enterprise_monitor, Primavera_analytics, Primavera_gateway, Rapid_planning, Retail_advanced_inventory_planning, Retail_assortment_planning, Retail_clearance_optimization_engine, Retail_financial_integration, Retail_integration_bus, Retail_invoice_matching, Retail_markdown_optimization, Retail_order_broker, Retail_predictive_application_server, Retail_service_backbone, Retail_xstore_point_of_service, Tape_library_acsls, Webcenter_sites, Weblogic_server, Spring_framework
|
7.5
|
|
|
|
2019-10-23
|
CVE-2019-12415
|
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
|
Poi, Application_testing_suite, Banking_enterprise_originations, Banking_enterprise_product_manufacturing, Banking_payments, Banking_platform, Big_data_discovery, Communications_diameter_signaling_router_idih\:, Endeca_information_discovery_studio, Enterprise_manager_base_platform, Enterprise_repository, Financial_services_analytical_applications_infrastructure, Financial_services_market_risk_measurement_and_management, Flexcube_private_banking, Hyperion_infrastructure_technology, Instantis_enterprisetrack, Insurance_policy_administration_j2ee, Insurance_rules_palette, Jdeveloper, Peoplesoft_enterprise_peopletools, Primavera_gateway, Primavera_unifier, Retail_clearance_optimization_engine, Retail_order_broker, Retail_predictive_application_server, Webcenter_portal, Webcenter_sites
|
5.5
|
|
|