Oracle Insurance Policy Administration j2ee vulnerabilities

18 CVEs affecting Oracle Insurance Policy Administration j2ee, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-35491, published 2020-12-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-5398, published 2020-01-17. High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days. In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it…
CVE-2018-8013, published 2018-05-24. Critical severity, CVSS 9.8. EPSS: 18.9% chance of exploitation in the next 30 days. In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of…
CVE-2018-15756, published 2018-10-18. High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days. Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving…
CVE-2020-9488, published 2020-04-27. Low severity, CVSS 3.7. EPSS: 8.2% chance of exploitation in the next 30 days. Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log…
CVE-2020-10673, published 2020-03-18. High severity, CVSS 8.8. EPSS: 8% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVE-2020-35491, published 2020-12-17. High severity, CVSS 8.1. EPSS: 7.8% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.
CVE-2020-10683, published 2020-05-01. Critical severity, CVSS 9.8. EPSS: 7.3% chance of exploitation in the next 30 days. dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing…
CVE-2020-35490, published 2020-12-17. High severity, CVSS 8.1. EPSS: 6.3% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
CVE-2020-11113, published 2020-03-31. High severity, CVSS 8.8. EPSS: 6.3% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
CVE-2016-0635, published 2016-07-21. High severity, CVSS 8.8. EPSS: 5.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component…

Latest

CVE-2020-11112, published 2020-03-31. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka…
CVE-2020-10969, published 2020-03-26. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
CVE-2020-10968, published 2020-03-26. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
CVE-2020-10672, published 2020-03-18. High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka…