Blockchain Platform (Oracle) - vulnerabilities (CVEs)

40 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2021-07-21. Vendor: Oracle.

CVEs of Blockchain Platform

CVE-2021-2351 - CVSS 8.3 (high), 2021-07-21: Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c.…
CVE-2021-23017 - CVSS 7.7 (high), 2021-06-01: A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory…
CVE-2021-29425 - CVSS 6.5 (medium), 2021-04-13: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result…
CVE-2020-36183 - CVSS 8.1 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36180 - CVSS 8.8 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36179 - CVSS 8.8 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36182 - CVSS 8.8 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36184 - CVSS 8.8 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36187 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36186 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36189 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36185 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36188 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36181 - CVSS 8.8 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-35728 - CVSS 8.1 (high), 2020-12-27: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-28052 - CVSS 8.1 (high), 2020-12-18: An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when…
CVE-2020-35491 - CVSS 8.1 (high), 2020-12-17: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-35490 - CVSS 8.1 (high), 2020-12-17: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-17527 - CVSS 7.5 (high), 2020-12-03: While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request…
CVE-2020-25649 - CVSS 7.5 (high), 2020-12-03: A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity…
CVE-2020-27218 - CVSS 4.8 (medium), 2020-11-28: In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is…
CVE-2020-8277 - CVSS 7.5 (high), 2020-11-19: A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, <…
CVE-2020-24750 - CVSS 8.1 (high), 2020-09-17: FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-24616 - CVSS 8.1 (high), 2020-08-25: FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-8174 - CVSS 8.1 (high), 2020-07-24: napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
CVE-2020-8203 - CVSS 7.4 (high), 2020-07-15: Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
CVE-2020-13935 - CVSS 7.5 (high), 2020-07-14: The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to…
CVE-2020-15719 - CVSS 4.2 (medium), 2020-07-14: libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN…
CVE-2020-8172 - CVSS 7.4 (high), 2020-06-08: TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
CVE-2020-11080 - CVSS 7.5 (high), 2020-06-03: In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious…
CVE-2020-11022 - CVSS 6.9 (medium), 2020-04-29: In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods…
CVE-2020-11023 - CVSS 6.9 (medium), 2020-04-29: In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing…
CVE-2020-5245 - CVSS 8.8 (high), 2020-02-24: Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account,…
CVE-2019-12399 - CVSS 7.5 (high), 2020-01-14: When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is…
CVE-2019-10086 - CVSS 7.3 (high), 2019-08-20: In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader…
CVE-2019-13565 - CVSS 7.5 (high), 2019-07-26: An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd…
CVE-2019-13057 - CVSS 4.9 (medium), 2019-07-26: An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain…
CVE-2017-17740 - CVSS 7.5 (high), 2017-12-18: contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that…
CVE-2017-14159 - CVSS 4.7 (medium), 2017-09-05: slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary…
CVE-2017-9287 - CVSS 6.5 (medium), 2017-05-29: servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd…