Retail Workforce Management Software CVEs and Security Vulnerabilities

CVE-2018-19362

jackson-databind: improper polymorphic deserialization in jboss-common-core class

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.

CVSS 3.0 · 9.8 Critical EPSS 10.6% KEV · Not listed

Vendors

Debian Fasterxml Oracle and 1 more

Products

Debian Linux Jackson-databind Business Process Management Suite and 19 more

CVE-2018-19361

jackson-databind: improper polymorphic deserialization in openjpa class

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.

CVSS 3.0 · 9.8 Critical EPSS 10.6% KEV · Not listed

Vendors

Debian Fasterxml Oracle and 1 more

Products

Debian Linux Jackson-databind Business Process Management Suite and 19 more

CVE-2018-19360

jackson-databind: improper polymorphic deserialization in axis2-transport-jms class

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.

CVSS 3.0 · 9.8 Critical EPSS 10.6% KEV · Not listed

Vendors

Debian Fasterxml Oracle and 1 more

Products

Debian Linux Jackson-databind Business Process Management Suite and 19 more

CVE-2018-14719

jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.

CVSS 3.1 · 9.8 Critical EPSS 9.7% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Oncommand Workflow Automation and 28 more

CVE-2018-14718

jackson-databind: arbitrary code execution in slf4j-ext class

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.

CVSS 3.1 · 9.8 Critical EPSS 12.7% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Oncommand Workflow Automation and 33 more

CVE-2015-9251

jquery: Cross-site scripting via cross-domain ajax requests

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

CVSS 3.0 · 6.1 Medium EPSS 29.7% KEV · Not listed

Vendors

Jquery Oracle Redhat

Products

Jquery Agile Product Lifecycle Management For Process Banking Platform and 48 more

Search vulnerabilities

jackson-databind: improper polymorphic deserialization in jboss-common-core class

jackson-databind: improper polymorphic deserialization in openjpa class

jackson-databind: improper polymorphic deserialization in axis2-transport-jms class

jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes

jackson-databind: arbitrary code execution in slf4j-ext class

jquery: Cross-site scripting via cross-domain ajax requests