Primavera Unifier (Oracle) - vulnerabilities (CVEs)

98 CVEs, 3 in the last 30 days, 51 known versions, newest CVE from 2026-10-20. Vendor: Oracle.

CVEs of Primavera Unifier

CVE-2026-101736 - CVSS 7.4 (high), 2026-10-20: Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core). Supported versions that are affected are…
CVE-2026-101735 - CVSS 7.1 (high), 2026-10-20: Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control). Supported versions that are affected are…
CVE-2026-101475 - CVSS 6.5 (medium), 2026-10-20: Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging). Supported versions that are affected are…
CVE-2022-25169 - CVSS 5.5 (medium), 2022-05-16: The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
CVE-2022-30126 - CVSS 5.5 (medium), 2022-05-16: In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by…
CVE-2020-36518 - CVSS 7.5 (high), 2022-03-11: jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVE-2021-44832 - CVSS 6.6 (medium), 2021-12-28: Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when…
CVE-2021-45105 - CVSS 5.9 (medium), 2021-12-18: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This…
CVE-2021-23450 - CVSS 9.8 (critical), 2021-12-17: All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
CVE-2021-41184 - CVSS 6.5 (medium), 2021-10-26: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from…
CVE-2021-41182 - CVSS 6.5 (medium), 2021-10-26: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from…
CVE-2021-42575 - CVSS 9.8 (critical), 2021-10-18: The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
CVE-2021-38153 - CVSS 5.9 (medium), 2021-09-22: Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for…
CVE-2021-37714 - CVSS 7.5 (high), 2021-08-18: jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If…
CVE-2021-2351 - CVSS 8.3 (high), 2021-07-21: Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c.…
CVE-2021-36374 - CVSS 5.5 (medium), 2021-07-14: When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out…
CVE-2021-36373 - CVSS 5.5 (medium), 2021-07-14: When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error,…
CVE-2021-35515 - CVSS 7.5 (high), 2021-07-13: When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be…
CVE-2021-36090 - CVSS 7.5 (high), 2021-07-13: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for…
CVE-2021-35517 - CVSS 7.5 (high), 2021-07-13: When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for…
CVE-2021-35516 - CVSS 7.5 (high), 2021-07-13: When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for…
CVE-2021-31811 - CVSS 5.5 (medium), 2021-06-12: In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23…
CVE-2021-29425 - CVSS 6.5 (medium), 2021-04-13: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result…
CVE-2021-28657 - CVSS 5.5 (medium), 2021-03-31: A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26…
CVE-2021-3449 - CVSS 5.9 (medium), 2021-03-25: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits…
CVE-2021-27906 - CVSS 5.5 (medium), 2021-03-19: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x…
CVE-2021-27807 - CVSS 5.5 (medium), 2021-03-19: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
CVE-2021-23337 - CVSS 7.2 (high), 2021-02-15: Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2020-28500 - CVSS 5.3 (medium), 2021-02-15: Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVE-2020-36183 - CVSS 8.1 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36182 - CVSS 8.8 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36180 - CVSS 8.8 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36179 - CVSS 8.8 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36186 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36189 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36185 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36188 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36184 - CVSS 8.8 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36187 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36181 - CVSS 8.8 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-35728 - CVSS 8.1 (high), 2020-12-27: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-35460 - CVSS 5.3 (medium), 2020-12-14: common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to…
CVE-2020-8908 - CVSS 3.3 (low), 2020-12-10: A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a…
CVE-2020-17521 - CVSS 5.5 (medium), 2020-12-07: Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was…
CVE-2020-13956 - CVSS 5.3 (medium), 2020-12-02: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as…
CVE-2020-11979 - CVSS 7.5 (high), 2020-10-01: As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access…
CVE-2020-25020 - CVSS 9.8 (critical), 2020-08-29: MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.
CVE-2020-14618 - CVSS 5.9 (medium), 2020-07-15: Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Mobile App). The supported version that is affected is Prior…
CVE-2020-14617 - CVSS 5.7 (medium), 2020-07-15: Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform, Mobile App). Supported versions that are affected…
CVE-2020-1945 - CVSS 6.3 (medium), 2020-05-14: Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and…
CVE-2020-9488 - CVSS 3.7 (low), 2020-04-27: Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a…
CVE-2020-9489 - CVSS 5.5 (medium), 2020-04-27: A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or…
CVE-2020-11620 - CVSS 8.1 (high), 2020-04-07: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-11619 - CVSS 8.1 (high), 2020-04-07: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-11112 - CVSS 8.8 (high), 2020-03-31: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-11111 - CVSS 8.8 (high), 2020-03-31: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka…
CVE-2020-11113 - CVSS 8.8 (high), 2020-03-31: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-10969 - CVSS 8.8 (high), 2020-03-26: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
CVE-2020-10968 - CVSS 8.8 (high), 2020-03-26: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-10673 - CVSS 8.8 (high), 2020-03-18: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-10672 - CVSS 8.8 (high), 2020-03-18: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-5258 - CVSS 7.7 (high), 2020-03-10: In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject…
CVE-2020-9548 - CVSS 9.8 (critical), 2020-03-02: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-9547 - CVSS 9.8 (critical), 2020-03-02: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-9546 - CVSS 9.8 (critical), 2020-03-02: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2019-20330 - CVSS 9.8 (critical), 2020-01-03: FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2019-17558 - CVSS 7.5 (high), 2019-12-30: Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided…
CVE-2019-10219 - CVSS 6.5 (medium), 2019-11-08: A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious…
CVE-2019-12415 - CVSS 5.5 (medium), 2019-10-23: In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an…
CVE-2019-16942 - CVSS 9.8 (critical), 2019-10-01: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a…
CVE-2019-14540 - CVSS 9.8 (critical), 2019-09-15: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-14379 - CVSS 9.8 (critical), 2019-07-29: SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of…
CVE-2019-13990 - CVSS 9.8 (critical), 2019-07-26: initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
CVE-2019-0227 - CVSS 7.5 (high), 2019-05-01: A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits…
CVE-2019-11358 - CVSS 6.1 (medium), 2019-04-20: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an…
CVE-2018-14718 - CVSS 9.8 (critical), 2019-01-02: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from…
CVE-2018-14721 - CVSS 10 (critical), 2019-01-02: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block…
CVE-2018-19362 - CVSS 9.8 (critical), 2019-01-02: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from…
CVE-2018-14720 - CVSS 9.8 (critical), 2019-01-02: FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK…
CVE-2018-19361 - CVSS 9.8 (critical), 2019-01-02: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic…
CVE-2018-14719 - CVSS 9.8 (critical), 2019-01-02: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and…
CVE-2018-19360 - CVSS 9.8 (critical), 2019-01-02: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from…
CVE-2018-3148 - CVSS 6.1 (medium), 2018-10-17: Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected…
CVE-2018-8032 - CVSS 6.1 (medium), 2018-08-02: Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVE-2018-2966 - CVSS 7.4 (high), 2018-07-18: Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core). Supported versions that are affected are…
CVE-2018-2969 - CVSS 4.3 (medium), 2018-07-18: Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core). The supported version that is affected is…
CVE-2018-2965 - CVSS 6.1 (medium), 2018-07-18: Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core). The supported version that is affected is…
CVE-2018-2968 - CVSS 6.5 (medium), 2018-07-18: Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core). Supported versions that are affected are…
CVE-2018-2967 - CVSS 5.3 (medium), 2018-07-18: Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core). Supported versions that are affected are…
CVE-2017-7525 - CVSS 9.8 (critical), 2018-02-06: A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to…
CVE-2017-15095 - CVSS 9.8 (critical), 2018-02-06: A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code…
CVE-2015-9251 - CVSS 6.1 (medium), 2018-01-18: jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing…
CVE-2018-2620 - CVSS 8.1 (high), 2018-01-18: Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Platform). Supported versions that are affected…
CVE-2017-10149 - CVSS 4.8 (medium), 2017-08-08: Vulnerability in the Primavera Unifier component of Oracle Primavera Products Suite (subcomponent: Platform). Supported versions that are affected are 9.13,…
CVE-2017-10150 - CVSS 4.3 (medium), 2017-08-08: Vulnerability in the Primavera Unifier component of Oracle Primavera Products Suite (subcomponent: Platform). Supported versions that are affected are 9.13,…
CVE-2017-3501 - CVSS 6.1 (medium), 2017-04-24: Vulnerability in the Primavera Unifier component of Oracle Primavera Products Suite (subcomponent: Platform). Supported versions that are affected are 9.13,…
CVE-2016-7103 - CVSS 6.1 (medium), 2017-03-15: Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText…
CVE-2016-4055 - CVSS 6.5 (medium), 2017-01-23: The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long…