Global Lifecycle Management Opatch vulnerabilities

Product

Global Lifecycle Management Opatch

by Oracle · last CVE Mar 11, 2022

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities25 In the news0 Timeline

Severity mix

Critical 10High 12Medium 3Low 0

Severity

All severities25 Critical10 High12 Medium3 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Global Lifecycle Management Opatch to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2020-9546	9.8	5%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 12.2.0.1.20
CVE-2020-9547	9.8	18%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 12.2.0.1.20
CVE-2020-9548	9.8	19%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka… Affected: before 12.2.0.1.20
CVE-2020-8840	9.8	27%	Feb 10	FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter Affected: before 11.2.0.3.23; 12.2.0.1.0 before 12.2.0.1.19; 13.9.4.0.0 before 13.9.4.2.1
CVE-2019-20330	9.8	9%	Jan 3	FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking Affected: before 11.2.0.3.23; 12.2.0.1.0 before 12.2.0.1.19; 13.9.4.0.0 before 13.9.4.2.1
CVE-2019-16335	9.8	5%	Sep 15	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: before 11.2.0.3.23; 12.2.0.1.0 before 12.2.0.1.19; 13.9.4.0.0 before 13.9.4.2.1
CVE-2019-14540	9.8	11%	Sep 15	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: before 11.2.0.3.23; 12.2.0.1.0 before 12.2.0.1.19; 13.9.4.0.0 before 13.9.4.2.1
CVE-2018-11307	9.8	6%	Jul 9	An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5 Affected: before 11.2.0.3.23; 12.2.0.1.0 before 12.2.0.1.19; 13.9.4.0.0 before 13.9.4.2.1
CVE-2018-14719	9.8	10%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from… Affected: before 11.2.0.3.23; 12.2.0.1.0 before 12.2.0.1.19; 13.9.4.0.0 before 13.9.4.2.1
CVE-2018-14718	9.8	13%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic… Affected: before 11.2.0.3.23; 12.2.0.1.0 before 12.2.0.1.19; 13.9.4.0.0 before 13.9.4.2.1
CVE-2020-11113	8.8	6%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka… Affected: before 12.2.0.1.20
CVE-2020-11112	8.8	4%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 12.2.0.1.20
CVE-2020-11111	8.8	4%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,… Affected: before 12.2.0.1.20
CVE-2020-10969	8.8	4%	Mar 26	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane Affected: before 12.2.0.1.20
CVE-2020-10968	8.8	4%	Mar 26	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider… Affected: before 12.2.0.1.20
CVE-2020-10673	8.8	8%	Mar 18	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka… Affected: before 12.2.0.1.20
CVE-2020-10672	8.8	3%	Mar 18	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 12.2.0.1.20
CVE-2020-11620	8.1	6%	Apr 7	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka… Affected: before 12.2.0.1.20
CVE-2020-11619	8.1	4%	Apr 7	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 12.2.0.1.20
CVE-2020-36518	7.5	5%	Mar 11	jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects Affected: before 12.2.0.1.30
CVE-2019-14439	7.5	11%	Jul 30	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2 Affected: before 11.2.0.3.23; 12.2.0.1.0 before 12.2.0.1.19; 13.9.4.0.0 before 13.9.4.2.1; 11.2.0.3.23; 13.9.4.2.1
CVE-2018-1320	7.5	8%	Jan 7	Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class Affected: before 11.2.0.3.23; 12.2.0.1.0 before 12.2.0.1.19; 13.9.4.0.0 before 13.9.4.2.1
CVE-2022-23437	6.5	12%	Jan 24	Infinite loop within Apache XercesJ xml parser Affected: before 12.2.0.1.30
CVE-2019-3740	6.5	4%	Sep 18	RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation Affected: before 12.2.0.1.22
CVE-2018-1000873	6.5	5%	Dec 20	Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS) Affected: before 11.2.0.3.23; 12.2.0.1.0 before 12.2.0.1.19; 13.9.4.0.0 before 13.9.4.2.1