AI
Product
Active IQ Unified Manager
On CISA KEVExploited in the wildRansomware-linked
848
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 54High 179Medium 267Low 0
Watch
Add Active IQ Unified Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-10096 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10090 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10089 | 9.6 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO) Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10087 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10086 | 9.6 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX) Affected: 7.3 and later; 9.5 and later |
| CVE-2023-23914 | 9.1 | Feb 23 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially Affected: All versions, or not specified |
| CVE-2022-1587 | 9.1 | May 16 | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file Affected: All versions, or not specified |
| CVE-2022-1586 | 9.1 | May 16 | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file Affected: All versions, or not specified |
| CVE-2021-35942 | 9.1 | Jul 22 | The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted… Affected: All versions, or not specified |
| CVE-2019-10744 | 9.1 | Jul 26 | Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution Affected: All versions, or not specified |
| CVE-2018-2938 | 9.0 | Jul 18 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Java DB) Affected: All versions, or not specified |
| CVE-2017-10102 | 9.0 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: 7.3 and later; 9.5 and later |
| CVE-2023-5178 | 8.8 | Nov 1 | Kernel: use after free in nvmet_tcp_free_crypto in nvme Affected: All versions, or not specified |
| CVE-2023-27533 | 8.8 | Mar 30 | A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet… Affected: All versions, or not specified |
| CVE-2023-27534 | 8.8 | Mar 30 | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in… Affected: All versions, or not specified |
| CVE-2022-3970 | 8.8 | Nov 13 | A vulnerability was found in LibTIFF Affected: All versions, or not specified |
| CVE-2022-27223 | 8.8 | Mar 16 | In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access Affected: All versions, or not specified |
| CVE-2022-24407 | 8.8 | Feb 23 | In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement Affected: All versions, or not specified |
| CVE-2021-45960 | 8.8 | Jan 1 | In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes,… Affected: All versions, or not specified |
| CVE-2021-3518 | 8.8 | May 18 | There's a flaw in libxml2 in versions before 2.9.11 Affected: All versions, or not specified |
| CVE-2019-10174 | 8.8 | Nov 25 | A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any… Affected: All versions, or not specified |
| CVE-2018-14550 | 8.8 | Jul 10 | An issue has been found in third-party PNM decoding associated with libpng 1.6.35 Affected: All versions, or not specified |
| CVE-2024-2398 | 8.6 | Mar 27 | HTTP/2 push headers memory-leak Affected: All versions, or not specified |
| CVE-2021-3517 | 8.6 | May 19 | There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11 Affected: All versions, or not specified |
| CVE-2020-14664 | 8.3 | Jul 15 | Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX) Affected: 7.3 and later; 9.5 and later |
| CVE-2020-14583 | 8.3 | Jul 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries) Affected: 7.3 and later; 9.5 and later |
| CVE-2020-2805 | 8.3 | Apr 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries) Affected: 7.3 and later; 9.5 and later |
| CVE-2020-2803 | 8.3 | Apr 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries) Affected: 7.3 and later; 9.5 and later |
| CVE-2018-2964 | 8.3 | Jul 18 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment) Affected: All versions, or not specified |
| CVE-2018-2942 | 8.3 | Jul 18 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL) Affected: All versions, or not specified |
| CVE-2018-2941 | 8.3 | Jul 18 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX) Affected: All versions, or not specified |
| CVE-2018-2638 | 8.3 | Jan 18 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment) Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10116 | 8.3 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10114 | 8.3 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX) Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10074 | 8.3 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.3 and later; 9.5 and later |
| CVE-2024-6387 | 8.1 | Jul 1 | Openssh: regresshion - race condition in ssh allows rce/dos Affected: All versions, or not specified |
| CVE-2024-22259 | 8.1 | Mar 16 | Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g Affected: All versions, or not specified |
| CVE-2020-10650 | 8.1 | Dec 26 | A deserialization flaw was discovered in jackson-databind through 2.9.10.4 Affected: All versions, or not specified |
| CVE-2022-31690 | 8.1 | Oct 31 | Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions Affected: All versions, or not specified |
| CVE-2022-27778 | 8.1 | Jun 1 | A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error` Affected: All versions, or not specified |
| CVE-2022-24903 | 8.1 | May 6 | Rsyslog is a rocket-fast system for log processing Affected: All versions, or not specified |
| CVE-2021-22901 | 8.1 | Jun 11 | curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection Affected: All versions, or not specified |
| CVE-2021-20305 | 8.1 | Apr 5 | A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography… Affected: All versions, or not specified |
| CVE-2021-20190 | 8.1 | Jan 19 | A flaw was found in jackson-databind before 2.9.10.7 Affected: All versions, or not specified |
| CVE-2020-24616 | 8.1 | Aug 25 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka… Affected: All versions, or not specified |
| CVE-2020-8174 | 8.1 | Jul 24 | napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0 Affected: All versions, or not specified |
| CVE-2020-14195 | 8.1 | Jun 16 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka… Affected: 7.3 and later; 7.3 and later; 9.5 and later |
| CVE-2020-14060 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool… Affected: 7.3 and later; 7.3 and later; 9.5 and later |
| CVE-2020-14061 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory,… Affected: 7.3 and later; 7.3 and later; 9.5 and later |
| CVE-2020-14062 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to… Affected: 7.3 and later; 7.3 and later; 9.5 and later |
The 500 most important CVEs for this product (exploited first, then by severity)