Primavera Unifier vulnerabilities | LiveThreat CVE Feed

Product

Primavera Unifier

by Oracle · last CVE May 16, 2022

On CISA KEVExploited in the wild

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities91 In the news0 Timeline

Severity mix

Critical 20High 34Medium 35Low 2

Severity

All severities91 Critical20 High34 Medium35 Low2

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add Primavera Unifier to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2019-17558 In wildKEV	7.5	99%	Dec 30	Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2018-14721	10.0	10%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class… Affected: 17.1 through 17.12; 16.1; 16.2; 18.8
CVE-2021-23450	9.8	30%	Dec 17	Prototype Pollution Affected: 17.7 through 17.12; 18.8; 19.12; 20.12; 21.12
CVE-2021-42575	9.8	3%	Oct 18	The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements Affected: 17.7 through 17.12; 18.8; 19.12; 20.12; 21.12
CVE-2020-25020	9.8	3%	Aug 29	MPXJ through 8.1.3 allows XXE attacks Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12; 20.12
CVE-2020-9546	9.8	5%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2020-9547	9.8	18%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2020-9548	9.8	19%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2019-20330	9.8	9%	Jan 3	FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2019-16942	9.8	6%	Oct 1	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2019-14540	9.8	11%	Sep 15	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2019-14379	9.8	8%	Jul 29	SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2019-13990	9.8	17%	Jul 26	initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2018-19362	9.8	11%	Jan 2	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2018-14718	9.8	13%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2018-14719	9.8	10%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2018-14720	9.8	8%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from… Affected: 17.1 through 17.12; 16.1; 16.2; 18.8
CVE-2018-19360	9.8	11%	Jan 2	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2018-19361	9.8	11%	Jan 2	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2017-7525	9.8	38%	Feb 6	A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by… Affected: 17.1 through 17.12; 16.1; 16.2; 18.8
CVE-2017-15095	9.8	8%	Feb 6	A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending… Affected: 17.1 through 17.12; 16.1; 16.2; 18.8
CVE-2020-11113	8.8	6%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2020-11112	8.8	4%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2020-11111	8.8	4%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2020-10969	8.8	4%	Mar 26	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2020-10968	8.8	4%	Mar 26	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2020-10673	8.8	8%	Mar 18	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2020-10672	8.8	3%	Mar 18	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2020-36182	8.1	4%	Jan 7	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 17.2; 18.8; 19.12; 20.12
CVE-2020-36180	8.1	4%	Jan 7	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 17.2; 18.8; 19.12; 20.12
CVE-2020-36179	8.1	17%	Jan 7	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 18.8; 19.12; 20.12
CVE-2020-36184	8.1	8%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 17.2; 18.8; 19.12; 20.12
CVE-2020-36181	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 17.2; 18.8; 19.12; 20.12
CVE-2020-36183	8.1	5%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 17.2; 18.8; 19.12; 20.12
CVE-2020-36185	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 17.2; 18.8; 19.12; 20.12
CVE-2020-36186	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 17.2; 18.8; 19.12; 20.12
CVE-2020-36187	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 17.2; 18.8; 19.12; 20.12
CVE-2020-36188	8.1	9%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 17.2; 18.8; 19.12; 20.12
CVE-2020-36189	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 18.8; 19.12; 20.12
CVE-2020-35728	8.1	13%	Dec 27	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 18.8 through 19.12; 20.12
CVE-2020-11620	8.1	6%	Apr 7	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2020-11619	8.1	4%	Apr 7	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2018-2620	8.1	1%	Jan 18	Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Platform) Affected: 10.0; 10.1; 15.0; 15.1; 15.2; 16.0; +3 more
CVE-2020-5258	7.7	4%	Mar 10	Prototype pollution in dojo Affected: 17.7 through 17.12; 18.8; 19.12; 20.12
CVE-2020-36518	7.5	5%	Mar 11	jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects Affected: 17.0 through 17.12; 18.0; 19.12; 20.12; 21.12
CVE-2021-37714	7.5	7%	Aug 18	Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions Affected: 20.12; 21.12
CVE-2021-35516	7.5	12%	Jul 13	When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs Affected: 17.7 through 17.12; 18.8; 19.12; 20.12
CVE-2021-35515	7.5	12%	Jul 13	When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop Affected: 17.7 through 17.12; 18.8; 19.12; 20.12
CVE-2021-36090	7.5	13%	Jul 13	Apache Commons Compress 1.0 to 1.20 denial of service vulnerability Affected: 17.7 through 17.12; 18.8; 19.12; 20.12
CVE-2021-35517	7.5	11%	Jul 13	Apache Commons Compress 1.1 to 1.20 denial of service vulnerability Affected: 17.7 through 17.12; 18.8; 19.12; 20.12