CS
Product
Communications Session Report Manager
On CISA KEVExploited in the wild
69
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 43Medium 18Low 2
Watch
Add Communications Session Report Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-0211 In wildKEV | 7.8 | Apr 8 | Apache HTTP Server Privilege Escalation Vulnerability Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2020-11023 In wildKEV | 6.1 | Apr 29 | Potential XSS vulnerability in jQuery Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2021-44790 | 9.8 | Dec 20 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts) Affected: through 9.0 |
| CVE-2020-11998 | 9.8 | Sep 10 | A regression has been introduced in the commit preventing JMX re-bind Affected: 8.0.0 through 8.2.2 |
| CVE-2020-11984 | 9.8 | Aug 7 | Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE Affected: 8.2.0 through 8.2.2 |
| CVE-2020-9546 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-9548 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka… Affected: 8.2.0 through 8.2.2 |
| CVE-2019-0228 | 9.8 | Apr 17 | Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF Affected: 8.0.0.0 through 8.2.4.0 |
| CVE-2020-11113 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-11112 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-11111 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-10969 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane Affected: 8.2.0 through 8.2.2 |
| CVE-2020-10968 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-10673 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-10672 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0 through 8.2.2 |
| CVE-2021-2351 | 8.3 | Jul 21 | Vulnerability in the Advanced Networking Option component of Oracle Database Server Affected: 8.0.0 through 8.2.5.0 |
| CVE-2021-44224 | 8.2 | Dec 20 | A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy… Affected: before 9.0 |
| CVE-2020-36182 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-36180 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-36179 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-36184 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-36181 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-36183 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-36185 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-36186 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-36187 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-36188 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-35728 | 8.1 | Dec 27 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-28052 | 8.1 | Dec 18 | An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66 Affected: 8.0.0 through 8.2.4.0 |
| CVE-2020-24750 | 8.1 | Sep 17 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-24616 | 8.1 | Aug 25 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka… Affected: 8.0.0.0 through 8.2.2.1 |
| CVE-2020-14195 | 8.1 | Jun 16 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-14060 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-14061 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory,… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-14062 | 8.1 | Jun 14 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to… Affected: 8.2.0 through 8.2.2 |
| CVE-2021-22118 | 7.8 | May 27 | In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary… Affected: 8.0.0 through 8.2.4.0 |
| CVE-2021-36090 | 7.5 | Jul 13 | Apache Commons Compress 1.0 to 1.20 denial of service vulnerability Affected: 8.2.0 through 8.2.5.0 |
| CVE-2021-22696 | 7.5 | Apr 2 | CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured… Affected: 8.0.0 through 8.2.4.0 |
| CVE-2021-28165 | 7.5 | Apr 1 | In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame Affected: 8.0.0.0 through 8.2.4.0 |
| CVE-2021-26117 | 7.5 | Jan 27 | The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server Affected: 8.2.0 through 8.2.2 |
| CVE-2020-9490 | 7.5 | Aug 7 | Apache HTTP Server versions 2.4.20 to 2.4.43 Affected: 8.2.0 through 8.2.2 |
| CVE-2020-11993 | 7.5 | Aug 7 | Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-11655 | 7.5 | Apr 9 | SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is… Affected: 8.2.0 through 8.2.2 |
| CVE-2020-5398 | 7.5 | Jan 16 | RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-12423 | 7.5 | Jan 16 | Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens… Affected: 8.2.0 through 8.2.2 |
| CVE-2019-12402 | 7.5 | Aug 30 | The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs Affected: 8.2.0 through 8.2.2 |
| CVE-2019-0227 | 7.5 | May 1 | A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006 Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2018-15756 | 7.5 | Oct 18 | DoS Attack via Range Requests Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-10097 | 7.2 | Sep 26 | In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could… Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2020-9484 | 7.0 | May 20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a… Affected: 8.2.0 through 8.2.2 |