BP
Product
Banking Platform
On CISA KEVExploited in the wild
72
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 29High 28Medium 15Low 0
Watch
Add Banking Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-11023 In wildKEV | 6.1 | Apr 29 | Potential XSS vulnerability in jQuery Affected: 2.4.0 through 2.10.0 |
| CVE-2018-14721 | 10.0 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class… Affected: 2.5.0; 2.6.0; 2.6.1; 2.6.2 |
| CVE-2021-21345 | 9.9 | Mar 22 | XStream is vulnerable to a Remote Command Execution attack Affected: 2.4.0; 2.7.1; 2.9.0; 2.12.0 |
| CVE-2021-21350 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 2.4.0; 2.7.1; 2.9.0; 2.12.0 |
| CVE-2021-21344 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 2.4.0; 2.7.1; 2.9.0; 2.12.0 |
| CVE-2021-21346 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 2.4.0; 2.7.1; 2.9.0; 2.12.0 |
| CVE-2021-21347 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 2.4.0; 2.7.1; 2.9.0; 2.12.0 |
| CVE-2020-10683 | 9.8 | May 1 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks Affected: 2.4.0 through 2.10.0 |
| CVE-2020-9546 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.4.0 through 2.9.0 |
| CVE-2020-9547 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.4.0 through 2.9.0 |
| CVE-2020-9548 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka… Affected: 2.4.0 through 2.9.0 |
| CVE-2019-20330 | 9.8 | Jan 3 | FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking Affected: 2.4.0 through 2.9.0 |
| CVE-2019-2904 | 9.8 | Oct 16 | Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces) Affected: 2.4.0; 2.4.1; 2.5.0; 2.6.0; 2.6.1; 2.6.2; +3 more |
| CVE-2019-17531 | 9.8 | Oct 12 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 2.4.0; 2.4.1; 2.5.0; 2.6.0; 2.6.1; 2.6.2; +3 more |
| CVE-2019-17495 | 9.8 | Oct 10 | A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input… Affected: 2.4.0 through 2.10.0 |
| CVE-2019-16943 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 2.4.0; 2.4.1; 2.5.0; 2.6.0; 2.6.1; 2.6.2; +3 more |
| CVE-2019-16942 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 2.4.0; 2.4.1; 2.5.0; 2.6.0; 2.6.1; 2.6.2; +3 more |
| CVE-2019-16335 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 2.4.0; 2.4.1; 2.5.0; 2.6.0; 2.6.1; 2.7.0; +1 more |
| CVE-2019-14540 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 2.4.0; 2.4.1; 2.5.0; 2.6.0; 2.6.1; 2.7.0; +1 more |
| CVE-2019-14379 | 9.8 | Jul 29 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of… Affected: 2.4.0; 2.4.1; 2.5.0; 2.6.0; 2.6.1; 2.7.0; +1 more |
| CVE-2019-10173 | 9.8 | Jul 23 | It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw Affected: 2.4.0 through 2.10.0; 2.4.0; 2.7.1; 2.9.0 |
| CVE-2018-14720 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from… Affected: 2.5.0; 2.6.0; 2.6.1; 2.6.2 |
| CVE-2018-14719 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from… Affected: 2.5.0; 2.6.0; 2.6.1; 2.6.2 |
| CVE-2018-14718 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic… Affected: 2.5.0; 2.6.0; 2.6.1; 2.6.2 |
| CVE-2018-1000613 | 9.8 | Jul 9 | Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select… Affected: 2.6.0; 2.6.1; 2.6.2 |
| CVE-2017-7525 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by… Affected: 2.5.0; 2.6.0; 2.6.1; 2.6.2 |
| CVE-2017-15095 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending… Affected: 2.5.0; 2.6.0; 2.6.1; 2.6.2 |
| CVE-2017-5645 | 9.8 | Apr 17 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary… Affected: 2.6.0; 2.6.1; 2.6.2 |
| CVE-2021-21351 | 9.1 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 2.4.0; 2.7.1; 2.9.0; 2.12.0 |
| CVE-2021-21342 | 9.1 | Mar 22 | A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host Affected: 2.4.0; 2.7.1; 2.9.0; 2.12.0 |
| CVE-2020-13936 | 8.8 | Mar 10 | An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet… Affected: 2.3.0 through 2.4.1; 2.6.2; 2.7.1 |
| CVE-2020-26217 | 8.8 | Nov 16 | Remote Code Execution in XStream Affected: 2.4.0; 2.7.1; 2.9.0 |
| CVE-2020-11113 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka… Affected: 2.4.0 through 2.9.0 |
| CVE-2020-11112 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.4.0 through 2.9.0 |
| CVE-2020-11111 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,… Affected: 2.4.0 through 2.9.0 |
| CVE-2020-10969 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane Affected: 2.4.0 through 2.9.0 |
| CVE-2020-10968 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider… Affected: 2.4.0 through 2.9.0 |
| CVE-2020-10673 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka… Affected: 2.4.0 through 2.9.0 |
| CVE-2020-10672 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.4.0 through 2.9.0 |
| CVE-2021-21349 | 8.6 | Mar 22 | A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host Affected: 2.4.0; 2.7.1; 2.9.0; 2.12.0 |
| CVE-2021-2351 | 8.3 | Jul 21 | Vulnerability in the Advanced Networking Option component of Oracle Database Server Affected: 2.6.2; 2.7.1; 2.12.0 |
| CVE-2020-36189 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.6.2; 2.7.0; 2.7.1; 2.8.0; 2.9.0; 2.10.0 |
| CVE-2020-35490 | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.6.2; 2.7.0; 2.7.1; 2.8.0; 2.9.0; 2.10.0 |
| CVE-2020-35491 | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.6.2; 2.7.0; 2.7.1; 2.8.0; 2.9.0; 2.10.0 |
| CVE-2020-11620 | 8.1 | Apr 7 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka… Affected: 2.4.0 through 2.9.0 |
| CVE-2020-11619 | 8.1 | Apr 7 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 2.4.0 through 2.9.0 |
| CVE-2016-1181 | 8.1 | Jul 4 | ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or… Affected: 2.3.0; 2.4.0; 2.4.1; 2.5.0 |
| CVE-2021-36090 | 7.5 | Jul 13 | Apache Commons Compress 1.0 to 1.20 denial of service vulnerability Affected: 2.6.2; 2.7.1; 2.9.0; 2.12.0 |
| CVE-2021-21348 | 7.5 | Mar 22 | XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) Affected: 2.4.0; 2.7.1; 2.9.0; 2.12.0 |
| CVE-2021-21341 | 7.5 | Mar 22 | XStream can cause a Denial of Service Affected: 2.4.0; 2.7.1; 2.9.0; 2.12.0 |