CVE-2020-10683
- EPSS 1.96%
- Veröffentlicht 01.05.2020 19:15:12
- Zuletzt bearbeitet 21.11.2024 04:55:50
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any a...
CVE-2020-11023
- EPSS 21.32%
- Veröffentlicht 29.04.2020 21:15:11
- Zuletzt bearbeitet 24.01.2025 02:00:02
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may ex...
CVE-2020-11620
- EPSS 2.8%
- Veröffentlicht 07.04.2020 23:15:12
- Zuletzt bearbeitet 21.11.2024 04:58:15
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
CVE-2020-11619
- EPSS 1.73%
- Veröffentlicht 07.04.2020 23:15:12
- Zuletzt bearbeitet 21.11.2024 04:58:15
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
CVE-2020-11112
- EPSS 11.42%
- Veröffentlicht 31.03.2020 05:15:13
- Zuletzt bearbeitet 21.11.2024 04:56:49
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
CVE-2020-11113
- EPSS 60.71%
- Veröffentlicht 31.03.2020 05:15:13
- Zuletzt bearbeitet 21.11.2024 04:56:49
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
CVE-2020-11111
- EPSS 2.2%
- Veröffentlicht 31.03.2020 05:15:13
- Zuletzt bearbeitet 21.11.2024 04:56:48
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
CVE-2020-10969
- EPSS 1.4%
- Veröffentlicht 26.03.2020 13:15:13
- Zuletzt bearbeitet 21.11.2024 04:56:28
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
CVE-2020-10968
- EPSS 6.63%
- Veröffentlicht 26.03.2020 13:15:12
- Zuletzt bearbeitet 21.11.2024 04:56:28
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
CVE-2020-10673
- EPSS 20.47%
- Veröffentlicht 18.03.2020 22:15:12
- Zuletzt bearbeitet 21.11.2024 04:55:49
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).