Vulnerabilities > Oracle > Primavera Unifier > 17.7

DATE CVE VULNERABILITY TITLE RISK
2019-01-02 CVE-2018-14720 Deserialization of Untrusted Data vulnerability in multiple products
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
network
low complexity
fasterxml debian oracle redhat CWE-502
critical
9.8
2019-01-02 CVE-2018-14719 Deserialization of Untrusted Data vulnerability in multiple products
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
network
low complexity
fasterxml debian oracle redhat netapp CWE-502
critical
9.8
2019-01-02 CVE-2018-14718 Deserialization of Untrusted Data vulnerability in multiple products
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
network
low complexity
fasterxml debian oracle netapp redhat CWE-502
critical
9.8
2018-10-17 CVE-2018-3148 Unspecified vulnerability in Oracle Primavera Unifier
Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Web Access).
network
oracle
5.8
2018-08-02 CVE-2018-8032 Cross-site Scripting vulnerability in multiple products
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
network
low complexity
apache oracle debian CWE-79
6.1
2018-07-18 CVE-2018-2968 Unspecified vulnerability in Oracle Primavera Unifier
Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core).
network
oracle
4.3
2018-07-18 CVE-2018-2967 Unspecified vulnerability in Oracle Primavera Unifier
Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core).
local
low complexity
oracle
2.1
2018-07-18 CVE-2018-2966 Unspecified vulnerability in Oracle Primavera Unifier
Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core).
network
oracle
4.3
2018-02-06 CVE-2017-7525 Incomplete Blacklist vulnerability in multiple products
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
network
low complexity
fasterxml debian netapp redhat oracle CWE-184
critical
9.8
2018-02-06 CVE-2017-15095 Deserialization of Untrusted Data vulnerability in multiple products
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
network
low complexity
fasterxml debian redhat netapp oracle CWE-502
critical
9.8