CE
Product
Communications Element Manager
On CISA KEVExploited in the wild
68
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 44Medium 15Low 2
Watch
Add Communications Element Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-27216 | 7.0 | Oct 23 | In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory… Affected: 8.2.1 through 8.2.2.1 |
| CVE-2020-9484 | 7.0 | May 20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a… Affected: 8.2.0 through 8.2.2 |
| CVE-2022-23437 | 6.5 | Jan 24 | Infinite loop within Apache XercesJ xml parser Affected: before 9.0 |
| CVE-2020-1941 | 6.1 | May 14 | In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2020-1927 | 6.1 | Apr 2 | In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to… Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-17573 | 6.1 | Jan 16 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-10092 | 6.1 | Sep 26 | In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2019-11358 | 6.1 | Apr 20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2018-8032 | 6.1 | Aug 2 | Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2021-45105 | 5.9 | Dec 18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups Affected: before 9.0 |
| CVE-2020-1954 | 5.3 | Apr 1 | Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus Affected: 8.2.0 through 8.2.2; 8.2.0 through 8.2.2 |
| CVE-2020-1934 | 5.3 | Apr 1 | In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2020-5397 | 5.3 | Jan 17 | Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux… Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-10247 | 5.3 | Apr 22 | In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured… Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2019-10246 | 5.3 | Apr 22 | In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a… Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2020-1935 | 4.8 | Feb 24 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP… Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2021-34428 | 3.5 | Jun 22 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in… Affected: 8.2.2 |
| CVE-2021-28163 | 2.7 | Apr 1 | In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory… Affected: 8.2.2 |