CC
Product
Communications Cloud Native Core Unified Data Repository
On CISA KEVExploited in the wild
42
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 28Medium 8Low 0
Watch
Add Communications Cloud Native Core Unified Data Repository to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22965 In wildKEV | 9.8 | Apr 1 | Spring Framework JDK 9+ Remote Code Execution Vulnerability Affected: 1.15.0; 22.1.0 |
| CVE-2022-22963 In wildKEV | 9.8 | Apr 1 | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability Affected: 1.15.0; 22.1.0 |
| CVE-2022-25845 | 9.8 | Jun 10 | The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under… Affected: 22.2.0 |
| CVE-2022-23219 | 9.8 | Jan 14 | The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating… Affected: 22.2.0 |
| CVE-2022-23218 | 9.8 | Jan 14 | The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating… Affected: 22.2.0 |
| CVE-2021-3711 | 9.8 | Aug 24 | SM2 Decryption Buffer Overflow Affected: 1.15.0 |
| CVE-2020-36182 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-36180 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-36179 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-36184 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-36181 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-36183 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-36185 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-36186 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-36187 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-36188 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-36189 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-35728 | 8.1 | Dec 27 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-35490 | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-35491 | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 1.4.0 |
| CVE-2020-24616 | 8.1 | Aug 25 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka… Affected: 1.4.0 |
| CVE-2021-22118 | 7.8 | May 27 | In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary… Affected: 1.14.0 |
| CVE-2020-36518 | 7.5 | Mar 11 | jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects Affected: 22.2.0 |
| CVE-2022-23308 | 7.5 | Feb 26 | valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes Affected: 22.2.0 |
| CVE-2021-43396 | 7.5 | Nov 4 | In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is… Affected: 22.2.0 |
| CVE-2021-37136 | 7.5 | Oct 19 | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression) Affected: 1.15.0 |
| CVE-2021-38604 | 7.5 | Aug 12 | In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference Affected: 22.2.0 |
| CVE-2021-35516 | 7.5 | Jul 13 | When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs Affected: 1.14.0 |
| CVE-2021-35515 | 7.5 | Jul 13 | When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop Affected: 1.14.0 |
| CVE-2021-36090 | 7.5 | Jul 13 | Apache Commons Compress 1.0 to 1.20 denial of service vulnerability Affected: 1.14.0 |
| CVE-2021-35517 | 7.5 | Jul 13 | Apache Commons Compress 1.1 to 1.20 denial of service vulnerability Affected: 1.14.0 |
| CVE-2020-25649 | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: 1.4.0 |
| CVE-2021-3712 | 7.4 | Aug 24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length Affected: 1.15.0 |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 1.6.0 |
| CVE-2021-43797 | 6.5 | Dec 9 | HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling Affected: 1.15.0 |
| CVE-2019-10219 | 6.1 | Nov 8 | A vulnerability was found in Hibernate-Validator Affected: 1.14.0 |
| CVE-2021-45105 | 5.9 | Dec 18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups Affected: 1.15.0 |
| CVE-2021-33880 | 5.9 | Jun 6 | The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with… Affected: 1.14.0 |
| CVE-2020-14340 | 5.9 | Jun 2 | A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles Affected: 1.14.0 |
| CVE-2021-28168 | 5.5 | Apr 22 | Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability Affected: 1.15.0 |
| CVE-2021-34429 | 5.3 | Jul 15 | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or… Affected: 1.14.0 |
| CVE-2021-29425 | 4.8 | Apr 13 | Possible limited path traversal vulnerabily in Apache Commons IO Affected: 1.4.0 |
Showing 42