Primavera Gateway (Oracle) - vulnerabilities (CVEs)

59 CVEs, 0 in the last 30 days, 41 known versions, newest CVE from 2023-01-18. Vendor: Oracle.

CVEs of Primavera Gateway

CVE-2023-21888 - CVSS 5.4 (medium), 2023-01-18: Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: WebUI). Supported versions that are affected are…
CVE-2020-36518 - CVSS 7.5 (high), 2022-03-11: jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVE-2022-23437 - CVSS 6.5 (medium), 2022-01-24: There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML…
CVE-2021-44832 - CVSS 6.6 (medium), 2021-12-28: Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when…
CVE-2021-45105 - CVSS 5.9 (medium), 2021-12-18: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This…
CVE-2021-41183 - CVSS 6.5 (medium), 2021-10-26: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from…
CVE-2021-2351 - CVSS 8.3 (high), 2021-07-21: Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c.…
CVE-2021-36373 - CVSS 5.5 (medium), 2021-07-14: When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error,…
CVE-2021-36374 - CVSS 5.5 (medium), 2021-07-14: When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out…
CVE-2021-36090 - CVSS 7.5 (high), 2021-07-13: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for…
CVE-2021-21409 - CVSS 5.9 (medium), 2021-03-30: Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers &…
CVE-2021-23337 - CVSS 7.2 (high), 2021-02-15: Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2020-28500 - CVSS 5.3 (medium), 2021-02-15: Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVE-2020-36183 - CVSS 8.1 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36182 - CVSS 8.8 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36180 - CVSS 8.8 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36179 - CVSS 8.8 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36189 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36185 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36188 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36184 - CVSS 8.8 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36187 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36186 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36181 - CVSS 8.8 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-35728 - CVSS 8.1 (high), 2020-12-27: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-17521 - CVSS 5.5 (medium), 2020-12-07: Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was…
CVE-2020-25649 - CVSS 7.5 (high), 2020-12-03: A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity…
CVE-2020-11979 - CVSS 7.5 (high), 2020-10-01: As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access…
CVE-2020-5421 - CVSS 8.7 (high), 2020-09-19: In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD…
CVE-2020-8203 - CVSS 7.4 (high), 2020-07-15: Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
CVE-2020-1945 - CVSS 6.3 (medium), 2020-05-14: Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and…
CVE-2020-11023 - CVSS 6.9 (medium), 2020-04-29: In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing…
CVE-2019-17571 - CVSS 9.8 (critical), 2019-12-20: Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary…
CVE-2019-10219 - CVSS 6.5 (medium), 2019-11-08: A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious…
CVE-2019-12415 - CVSS 5.5 (medium), 2019-10-23: In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an…
CVE-2019-17195 - CVSS 9.8 (critical), 2019-10-15: Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential…
CVE-2019-17531 - CVSS 9.8 (critical), 2019-10-12: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a…
CVE-2019-17495 - CVSS 9.8 (critical), 2019-10-10: A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to…
CVE-2019-16943 - CVSS 9.8 (critical), 2019-10-01: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a…
CVE-2019-16942 - CVSS 9.8 (critical), 2019-10-01: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a…
CVE-2019-16335 - CVSS 9.8 (critical), 2019-09-15: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a…
CVE-2019-14540 - CVSS 9.8 (critical), 2019-09-15: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-12402 - CVSS 7.5 (high), 2019-08-30: The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted…
CVE-2019-10086 - CVSS 7.3 (high), 2019-08-20: In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader…
CVE-2019-14439 - CVSS 7.5 (high), 2019-07-30: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for…
CVE-2019-14379 - CVSS 9.8 (critical), 2019-07-29: SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of…
CVE-2019-0227 - CVSS 7.5 (high), 2019-05-01: A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits…
CVE-2019-11358 - CVSS 6.1 (medium), 2019-04-20: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an…
CVE-2018-15756 - CVSS 7.5 (high), 2018-10-18: Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide…
CVE-2018-8032 - CVSS 6.1 (medium), 2018-08-02: Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVE-2018-1257 - CVSS 6.5 (medium), 2018-05-11: Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over…
CVE-2018-1275 - CVSS 9.8 (critical), 2018-04-11: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over…
CVE-2018-1271 - CVSS 5.9 (medium), 2018-04-06: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to…
CVE-2018-1270 - CVSS 9.8 (critical), 2018-04-06: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over…
CVE-2018-1272 - CVSS 7.5 (high), 2018-04-06: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart…
CVE-2015-9251 - CVSS 6.1 (medium), 2018-01-18: jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing…
CVE-2017-3508 - CVSS 9.1 (critical), 2017-04-24: Vulnerability in the Primavera Gateway component of Oracle Primavera Products Suite (subcomponent: Primavera Desktop Integration). Supported versions that are…
CVE-2017-3500 - CVSS 8.7 (high), 2017-04-24: Vulnerability in the Primavera Gateway component of Oracle Primavera Products Suite (subcomponent: Primavera Desktop Integration). Supported versions that are…
CVE-2017-5645 - CVSS 9.8 (critical), 2017-04-17: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially…