CE
Product
Communications Element Manager
On CISA KEVExploited in the wild
68
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 44Medium 15Low 2
Watch
Add Communications Element Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-22112 | 8.8 | Feb 23 | Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is… Affected: 8.2.0 through 8.2.4.0 |
| CVE-2020-11113 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-11112 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-11111 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-10969 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane Affected: 8.2.0 through 8.2.2 |
| CVE-2020-10968 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-10673 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-10672 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0 through 8.2.2 |
| CVE-2021-44224 | 8.2 | Dec 20 | A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy… Affected: before 9.0 |
| CVE-2020-36182 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0.0 through 8.2.4.0 |
| CVE-2020-36180 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0.0 through 8.2.4.0 |
| CVE-2020-36179 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0.0 through 8.2.4.0 |
| CVE-2020-36184 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0.0 through 8.2.4.0 |
| CVE-2020-36181 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0.0 through 8.2.4.0 |
| CVE-2020-36183 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0.0 through 8.2.4.0 |
| CVE-2020-36185 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0.0 through 8.2.4.0 |
| CVE-2020-36186 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0.0 through 8.2.4.0 |
| CVE-2020-36187 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0.0 through 8.2.4.0 |
| CVE-2020-36188 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0.0 through 8.2.4.0 |
| CVE-2020-35728 | 8.1 | Dec 27 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0.0 through 8.2.4.0 |
| CVE-2020-24750 | 8.1 | Sep 17 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0 through 8.2.4.0 |
| CVE-2020-24616 | 8.1 | Aug 25 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka… Affected: 8.2.0 through 8.2.4.0 |
| CVE-2020-14195 | 8.1 | Jun 16 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-14060 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-14061 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory,… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-14062 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0 through 8.2.2 |
| CVE-2021-22118 | 7.8 | May 27 | In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary… Affected: 8.2.0 through 8.2.4.0 |
| CVE-2021-36090 | 7.5 | Jul 13 | Apache Commons Compress 1.0 to 1.20 denial of service vulnerability Affected: 8.2.0 through 8.2.4.0 |
| CVE-2021-30468 | 7.5 | Jun 16 | A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an… Affected: 8.2.2 |
| CVE-2021-22696 | 7.5 | Apr 2 | CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured… Affected: 8.2.2 |
| CVE-2021-28165 | 7.5 | Apr 1 | In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame Affected: 8.2.2 |
| CVE-2021-26117 | 7.5 | Jan 27 | The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server Affected: 8.2.0 through 8.2.4.0 |
| CVE-2020-9490 | 7.5 | Aug 7 | Apache HTTP Server versions 2.4.20 to 2.4.43 Affected: 8.2.0 through 8.2.2 |
| CVE-2020-11993 | 7.5 | Aug 7 | Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-11655 | 7.5 | Apr 9 | SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-5398 | 7.5 | Jan 16 | RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-12423 | 7.5 | Jan 16 | Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens… Affected: 8.2.0 through 8.2.2 |
| CVE-2019-12402 | 7.5 | Aug 30 | The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs Affected: 8.2.0 through 8.2.2 |
| CVE-2019-9517 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2019-0227 | 7.5 | May 1 | A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006 Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2018-15756 | 7.5 | Oct 18 | DoS Attack via Range Requests Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-10097 | 7.2 | Sep 26 | In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could… Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2020-27216 | 7.0 | Oct 23 | In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory… Affected: 8.2.1 through 8.2.2.1 |
| CVE-2020-9484 | 7.0 | May 20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a… Affected: 8.2.0 through 8.2.2 |
Showing 44