PU
Product
Primavera Unifier
On CISA KEVExploited in the wild
91
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 20High 34Medium 35Low 2
Watch
Add Primavera Unifier to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-44832 | 6.6 | Dec 28 | Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses… Affected: 18.8; 19.12; 20.12; 21.12; 18.8; 19.12; +2 more |
| CVE-2018-2968 | 6.5 | Jul 18 | Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core) Affected: 16.1; 16.2; 16.2.1.0; 16.2.4.0; 17.1; 17.2; +17 more |
| CVE-2016-4055 | 6.5 | Jan 23 | The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular… Affected: 16.0 through 18.8.4 |
| CVE-2020-1945 | 6.3 | May 14 | Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12 |
| CVE-2021-41184 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 17.7 through 17.12; 18.8; 19.12; 20.12; 21.12 |
| CVE-2021-41182 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: 17.7; 17.8; 17.9; 17.10; 17.11; 17.12; +9 more |
| CVE-2018-3148 | 6.1 | Oct 17 | Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Web Access) Affected: 17.1 through 17.12; 18.1 through 18.8; 15.1; 15.2; 16.1; 16.2 |
| CVE-2018-8032 | 6.1 | Aug 2 | Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12 |
| CVE-2018-2965 | 6.1 | Jul 18 | Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core) Affected: 16.1; 16.2; 16.2.1.0; 16.2.4.0 |
| CVE-2015-9251 | 6.1 | Jan 18 | jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript… Affected: 17.1 through 17.12; 16.1; 16.2; 18.8 |
| CVE-2017-3501 | 6.1 | Apr 24 | Vulnerability in the Primavera Unifier component of Oracle Primavera Products Suite (subcomponent: Platform) Affected: 9.13; 9.14; 10.0; 10.1; 15.1; 15.2 |
| CVE-2016-7103 | 6.1 | Mar 15 | Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog… Affected: 16.0 through 16.2; 17.0 through 17.12.4; 18.0 through 18.8.4 |
| CVE-2021-38153 | 5.9 | Sep 22 | Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more… Affected: 18.8; 19.12; 20.12; 21.12 |
| CVE-2021-3449 | 5.9 | Mar 25 | NULL pointer deref in signature_algorithms processing Affected: 17.7 through 17.12; 19.12; 20.12; 21.12 |
| CVE-2020-14618 | 5.9 | Jul 15 | Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Mobile App) Affected: before 20.6; before 20.6 |
| CVE-2020-14617 | 5.7 | Jul 15 | Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform, Mobile App) Affected: before 20.6; before 20.6; 17.7 through 17.12; 16.1; 16.2; 18.8; +1 more |
| CVE-2022-30126 | 5.5 | May 16 | In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a… Affected: 17.7 through 17.12; 18.8; 19.12; 20.12; 21.12 |
| CVE-2022-25169 | 5.5 | May 16 | The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files Affected: 17.7 through 17.12; 18.8; 19.12; 20.12; 21.12 |
| CVE-2021-36374 | 5.5 | Jul 14 | When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even… Affected: 17.7 through 17.12; 18.8; 19.12; 20.12 |
| CVE-2021-36373 | 5.5 | Jul 14 | When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small… Affected: 17.7 through 17.12; 18.8; 19.12; 20.12 |
| CVE-2021-31811 | 5.5 | Jun 12 | In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file Affected: 17.7 through 17.12; 18.8; 19.12; 20.12 |
| CVE-2021-28657 | 5.5 | Mar 31 | A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25 Affected: 17.7 through 17.12; 18.8; 19.12; 20.12 |
| CVE-2021-27906 | 5.5 | Mar 19 | A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file Affected: 17.7 through 17.12; 18.8; 19.12; 20.12 |
| CVE-2021-27807 | 5.5 | Mar 19 | A carefully crafted PDF file can trigger an infinite loop while loading the file Affected: 17.7 through 17.12; 18.8; 19.12; 20.12 |
| CVE-2020-17521 | 5.5 | Dec 7 | Apache Groovy provides extension methods to aid with creating temporary directories Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12; 20.12 |
| CVE-2020-9489 | 5.5 | Apr 27 | A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12 |
| CVE-2019-12415 | 5.5 | Oct 23 | In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12 |
| CVE-2020-28500 | 5.3 | Feb 15 | Regular Expression Denial of Service (ReDoS) Affected: 17.7 through 17.12; 18.8; 19.12; 20.12 |
| CVE-2020-35460 | 5.3 | Dec 14 | common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12; 21.12 |
| CVE-2020-13956 | 5.3 | Dec 2 | Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12; 20.12 |
| CVE-2018-2967 | 5.3 | Jul 18 | Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core) Affected: 16.1; 16.2; 16.2.1.0; 16.2.4.0; 17.1; 17.2; +17 more |
| CVE-2021-29425 | 4.8 | Apr 13 | Possible limited path traversal vulnerabily in Apache Commons IO Affected: 17.7 through 17.12; 18.8; 19.12; 20.12; 21.12 |
| CVE-2017-10149 | 4.8 | Aug 8 | Vulnerability in the Primavera Unifier component of Oracle Primavera Products Suite (subcomponent: Platform) Affected: 9.13; 9.14; 10.1; 10.2; 15.1; 15.2; +2 more |
| CVE-2018-2969 | 4.3 | Jul 18 | Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core) Affected: 16.1; 16.2; 16.2.1.0; 16.2.4.0 |
| CVE-2017-10150 | 4.3 | Aug 8 | Vulnerability in the Primavera Unifier component of Oracle Primavera Products Suite (subcomponent: Platform) Affected: 9.13; 9.14; 10.1; 10.2; 15.1; 15.2; +2 more |
Showing 35