oracle nosql database vulnerabilities

Latest oracle nosql database CVEs

Newest publication first

1. CVE-2021-21409 Possible request smuggling in HTTP/2 due missing validation of content-length

   Published 2021-03-30

   Medium·CVSS 5.9 EPSS 4.9%

   Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smug...

2. CVE-2021-22883 Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of f...

   Published 2021-03-03

   High·CVSS 7.5 EPSS 77.4%

   Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then th...

3. CVE-2021-22884 Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordin...

   Published 2021-03-03

   High·CVSS 7.5 EPSS 36.8%

   Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker control...

4. CVE-2021-23840 Integer overflow in CipherUpdate

   Published 2021-02-16

   High·CVSS 7.5 EPSS 51.1%

   Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be...

5. CVE-2021-21290 Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

   Published 2021-02-08

   Medium·CVSS 5.5 EPSS 1.8%

   Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file....

6. CVE-2020-8908 Temp directory permission issue in Guava

   Published 2020-12-10

   Low·CVSS 3.3 EPSS 0.92%

   A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the...

7. CVE-2020-13956 Cross-site scripting in Apache HttpClient

   Published 2020-12-02

   Medium·CVSS 5.3 EPSS 9.0%

   Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

8. CVE-2020-11612 Denial of Service in Netty

   Published 2020-04-07

   High·CVSS 7.5 EPSS 9.2%

   The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

9. CVE-2019-10219 The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks

   Published 2019-11-08

   Medium·CVSS 6.1 EPSS 2.2% PoC

   A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

10. CVE-2018-1320 Improper Input Validation in Apache Thrift

    Published 2019-01-07

    High·CVSS 7.5 EPSS 8.2%

    Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production...

11. CVE-2018-14718 Arbitrary Code Execution in jackson-databind

    Published 2019-01-02

    Critical·CVSS 9.8 EPSS 12.7%

    FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.

12. CVE-2018-1000873 Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353

    Published 2018-12-20

    Medium·CVSS 6.5 EPSS 4.8%

    Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very larg...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.