Skip to content

Product

oracle blockchain platform vulnerabilities

40 published CVES affecting oracle blockchain platform, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
40
Critical
0
High
32
Medium
8
Low
0
Unscored
0
CISA KEV
1

Latest oracle blockchain platform CVEs

Newest publication first · page 1 of 2

  1. CVE-2021-2351 Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unau...

    Published
    HighCVSS 7.5 EPSS 2.4%

    Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced N...

  3. CVE-2021-29425 Possible limited path traversal vulnerabily in Apache Commons IO

    Published
    MediumCVSS 4.8 EPSS 10.5% PoC

    In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limite...

  8. CVE-2020-36184 Unsafe Deserialization in jackson-databind

    Published
    HighCVSS 8.1 EPSS 8.4%

    FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

  9. CVE-2020-36185 Unsafe Deserialization in jackson-databind

    Published
    HighCVSS 8.1 EPSS 4.2%

    FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

  10. CVE-2020-36186 Unsafe Deserialization in jackson-databind

    Published
    HighCVSS 8.1 EPSS 4.2%

    FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

  12. CVE-2020-36188 Unsafe Deserialization in jackson-databind

    Published
    HighCVSS 8.1 EPSS 8.8%

    FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

  13. CVE-2020-36189 Unsafe Deserialization in jackson-databind

    Published
    HighCVSS 8.1 EPSS 4.0%

    FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

  15. CVE-2020-35728 Serialization gadget exploit in jackson-databind

    Published
    HighCVSS 8.1 EPSS 12.5%

    FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

  16. CVE-2020-28052 Logic error in Legion of the Bouncy Castle BC Java

    Published
    HighCVSS 8.1 EPSS 7.2% PoC

    An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were diffe...

  19. CVE-2020-17527 Apache Tomcat: Request header mix-up between HTTP/2 streams

    Published
    HighCVSS 7.5 EPSS 24.6%

    While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent str...

  21. CVE-2020-27218 Buffer not correctly recycled in Gzip Request inflation

    Published
    MediumCVSS 4.8 EPSS 8.3%

    In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request...

  22. CVE-2020-8277 A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the applic...

    Published
    HighCVSS 7.5 EPSS 54.2%

    A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed i...

  24. CVE-2020-24616 Code Injection in jackson-databind

    Published
    HighCVSS 8.1 EPSS 7.6%

    FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.