Primavera Unifier vulnerabilities | LiveThreat CVE Feed

Product

Primavera Unifier

by Oracle · last CVE May 16, 2022

On CISA KEVExploited in the wild

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities91 In the news0 Timeline

Severity mix

Critical 20High 34Medium 35Low 2

Severity

All severities91 Critical20 High34 Medium35 Low2

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add Primavera Unifier to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2018-14721	10.0	10%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class… Affected: 17.1 through 17.12; 16.1; 16.2; 18.8
CVE-2021-23450	9.8	30%	Dec 17	Prototype Pollution Affected: 17.7 through 17.12; 18.8; 19.12; 20.12; 21.12
CVE-2021-42575	9.8	3%	Oct 18	The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements Affected: 17.7 through 17.12; 18.8; 19.12; 20.12; 21.12
CVE-2020-25020	9.8	3%	Aug 29	MPXJ through 8.1.3 allows XXE attacks Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12; 20.12
CVE-2020-9546	9.8	5%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2020-9547	9.8	18%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2020-9548	9.8	19%	Mar 2	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2019-20330	9.8	9%	Jan 3	FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2019-16942	9.8	6%	Oct 1	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2019-14540	9.8	11%	Sep 15	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 17.7 through 17.12; 16.1; 16.2; 18.8; 19.12
CVE-2019-14379	9.8	8%	Jul 29	SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2019-13990	9.8	17%	Jul 26	initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2018-19362	9.8	11%	Jan 2	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2018-14718	9.8	13%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2018-14719	9.8	10%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2018-14720	9.8	8%	Jan 2	FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from… Affected: 17.1 through 17.12; 16.1; 16.2; 18.8
CVE-2018-19360	9.8	11%	Jan 2	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic… Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2018-19361	9.8	11%	Jan 2	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization Affected: 17.7 through 17.12; 16.1; 16.2; 18.8
CVE-2017-7525	9.8	38%	Feb 6	A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by… Affected: 17.1 through 17.12; 16.1; 16.2; 18.8
CVE-2017-15095	9.8	8%	Feb 6	A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending… Affected: 17.1 through 17.12; 16.1; 16.2; 18.8