Oracle Documaker vulnerabilities

23 CVEs affecting Oracle Documaker, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-37695, published 2021-08-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-13990, published 2019-07-26. Critical severity, CVSS 9.8. EPSS: 16.6% chance of exploitation in the next 30 days. initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
CVE-2020-36188, published 2021-01-06. High severity, CVSS 8.1. EPSS: 8.8% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
CVE-2020-36184, published 2021-01-06. High severity, CVSS 8.1. EPSS: 8.3% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
CVE-2020-35491, published 2020-12-17. High severity, CVSS 8.1. EPSS: 7.8% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.
CVE-2020-10683, published 2020-05-01. Critical severity, CVSS 9.8. EPSS: 7.3% chance of exploitation in the next 30 days. dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing…
CVE-2020-35490, published 2020-12-17. High severity, CVSS 8.1. EPSS: 6.3% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
CVE-2016-0635, published 2016-07-21. High severity, CVSS 8.8. EPSS: 5.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component…
CVE-2020-36183, published 2021-01-07. High severity, CVSS 8.1. EPSS: 5% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.
CVE-2019-5427, published 2019-04-22. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
CVE-2020-36187, published 2021-01-06. High severity, CVSS 8.1. EPSS: 4.2% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

Latest

CVE-2021-37695, published 2021-08-13. Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days. ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects)…
CVE-2021-32809, published 2021-08-12. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package.…
CVE-2021-32808, published 2021-08-12. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability…
CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2021-22118, published 2021-05-27. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory,…
CVE-2020-36182, published 2021-01-07. High severity, CVSS 8.1. EPSS: 4.1% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.
CVE-2020-36180, published 2021-01-07. High severity, CVSS 8.1. EPSS: 4.1% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.
CVE-2020-36189, published 2021-01-06. High severity, CVSS 8.1. EPSS: 4% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…