JE
Product
JD Edwards Enterpriseone Tools
On CISA KEVExploited in the wildRansomware-linked
170
CVEs
2
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 33High 55Medium 68Low 5
Watch
Add JD Edwards Enterpriseone Tools to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-36184 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36181 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36183 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36185 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36186 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36187 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36188 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-36189 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: through 9.2.5.3 |
| CVE-2020-35728 | 8.1 | Dec 27 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.5.3 |
| CVE-2020-28052 | 8.1 | Dec 18 | An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66 Affected: through 9.2.5.3 |
| CVE-2020-11620 | 8.1 | Apr 7 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka… Affected: before 9.2.4.2 |
| CVE-2020-11619 | 8.1 | Apr 7 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: before 9.2.4.2 |
| CVE-2025-21511 | 7.5 | Jan 21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC) Affected: before 9.2.9.0 |
| CVE-2025-21510 | 7.5 | Jan 21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC) Affected: before 9.2.9.0 |
| CVE-2021-22940 | 7.5 | Aug 16 | Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior Affected: through 9.2.6.1 |
| CVE-2021-22884 | 7.5 | Mar 3 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6” Affected: before 9.2.6.0 |
| CVE-2021-22883 | 7.5 | Mar 3 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established Affected: before 9.2.6.0 |
| CVE-2021-23840 | 7.5 | Feb 16 | Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable… Affected: before 9.2.6.0 |
| CVE-2020-25649 | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: before 9.2.5.3 |
| CVE-2020-8277 | 7.5 | Nov 19 | A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1… Affected: before 9.2.6.0 |
| CVE-2019-17566 | 7.5 | Nov 12 | Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes Affected: before 9.2.4.0; 9.2.4.2 |
| CVE-2020-25648 | 7.5 | Oct 20 | A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3 Affected: before 9.2.6.0 |
| CVE-2019-14439 | 7.5 | Jul 30 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2 Affected: 9.2 |
| CVE-2018-12022 | 7.5 | Mar 17 | An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 Affected: 9.2 |
| CVE-2018-12023 | 7.5 | Mar 17 | An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 Affected: 9.2 |
| CVE-2018-15769 | 7.5 | Nov 16 | RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key management error issue Affected: 9.2 |
| CVE-2018-11054 | 7.5 | Aug 31 | RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability Affected: 9.2 |
| CVE-2018-2944 | 7.5 | Jul 18 | Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Monitoring and Diagnostics) Affected: 9.2 |
| CVE-2016-8610 | 7.5 | Nov 13 | A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection… Affected: 9.2 |
| CVE-2017-3730 | 7.5 | May 4 | In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL… Affected: 9.2 |
| CVE-2022-21542 | 7.4 | Jul 19 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime) Affected: through 9.2.6.3 |
| CVE-2021-3712 | 7.4 | Aug 24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length Affected: before 9.2.6.3 |
| CVE-2021-32066 | 7.4 | Aug 1 | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1 Affected: before 9.2.6.1 |
| CVE-2021-3450 | 7.4 | Mar 25 | CA certificate check bypass with X509_V_FLAG_X509_STRICT Affected: before 9.2.6.0 |
| CVE-2020-8203 | 7.4 | Jul 15 | Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20 Affected: through 9.2.6.0 |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: before 9.2.5.3; 9.2.5.3 |
| CVE-2021-23337 | 7.2 | Feb 15 | Command Injection Affected: before 9.2.6.1 |
| CVE-2021-31799 | 7.0 | Jul 30 | In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename Affected: before 9.2.6.1 |
| CVE-2020-27216 | 7.0 | Oct 23 | In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory… Affected: before 9.2.6.0 |
| CVE-2025-30740 | 6.5 | Apr 15 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC) Affected: 9.2.0.0 through 9.2.9.2 |
| CVE-2025-21509 | 6.5 | Jan 21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC) Affected: before 9.2.9.0 |
| CVE-2025-21508 | 6.5 | Jan 21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC) Affected: before 9.2.9.0 |
| CVE-2022-21561 | 6.5 | Jul 19 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime) Affected: through 9.2.6.3 |
| CVE-2021-26272 | 6.5 | Jan 26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space… Affected: before 9.2.6.0 |
| CVE-2021-26271 | 6.5 | Jan 26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the… Affected: before 9.2.6.0 |
| CVE-2018-11056 | 6.5 | Aug 31 | RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled Resource Consumption… Affected: 9.2 |
| CVE-2018-2947 | 6.5 | Jul 18 | Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Web Runtime) Affected: 9.2 |
| CVE-2017-3517 | 6.5 | Apr 24 | Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Web Runtime SEC) Affected: 9.2 |
| CVE-2015-1793 | 6.5 | Jul 9 | The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during… Affected: 9.1; 9.2 |
| CVE-2017-15707 | 6.2 | Dec 1 | In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially… Affected: 9.2 |