CVE-2020-11998
- EPSS 7.58%
- Veröffentlicht 10.09.2020 19:15:13
- Zuletzt bearbeitet 21.11.2024 04:59:05
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https:...
CVE-2020-24616
- EPSS 3.78%
- Veröffentlicht 25.08.2020 18:15:11
- Zuletzt bearbeitet 21.11.2024 05:15:09
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
CVE-2020-9490
- EPSS 75.82%
- Veröffentlicht 07.08.2020 16:15:12
- Zuletzt bearbeitet 21.11.2024 05:40:45
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via ...
CVE-2020-11984
- EPSS 76.31%
- Veröffentlicht 07.08.2020 16:15:11
- Zuletzt bearbeitet 21.11.2024 04:59:02
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
CVE-2020-11993
- EPSS 38.85%
- Veröffentlicht 07.08.2020 16:15:11
- Zuletzt bearbeitet 01.05.2025 15:40:19
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLev...
CVE-2020-14195
- EPSS 9.51%
- Veröffentlicht 16.06.2020 16:15:11
- Zuletzt bearbeitet 21.11.2024 05:02:50
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
CVE-2020-14060
- EPSS 8.72%
- Veröffentlicht 14.06.2020 21:15:09
- Zuletzt bearbeitet 21.11.2024 05:02:27
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
CVE-2020-14062
- EPSS 7.71%
- Veröffentlicht 14.06.2020 20:15:10
- Zuletzt bearbeitet 21.11.2024 05:02:28
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).
CVE-2020-14061
- EPSS 6.15%
- Veröffentlicht 14.06.2020 20:15:10
- Zuletzt bearbeitet 27.08.2025 21:15:35
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, o...
- EPSS 93.33%
- Veröffentlicht 20.05.2020 19:15:09
- Zuletzt bearbeitet 21.11.2024 05:40:44
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the Persiste...