Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2680▼ 660 respecto a la semana anterior
Críticas / altas1277▼ 279 respecto a la semana anterior
Nueva explotación activa (KEV)3▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)228▼ 274 respecto a la semana anterior
574 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Alta (8.8) | 3.1% | — | Fasterxml Jackson-databindDebian LinuxNetapp Steelstore Cloud Integrated StorageOracle Agile Product Lifecycle Management+27 | 18/3/2020 | 25/8/2026 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms). | |
| Modificada | Alta (7.5) | 0.88% | — | Salesagility Suitecrm | 16/3/2020 | 17/6/2026 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted. | |
| Modificada | Crítica (9.8) | 1.1% | — | Salesagility Suitecrm | 16/3/2020 | 17/6/2026 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4). | |
| Modificada | Crítica (9.8) | 1.1% | — | Salesagility Suitecrm | 16/3/2020 | 17/6/2026 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4). | |
| Modificada | Crítica (9.8) | 1.1% | — | Salesagility Suitecrm | 16/3/2020 | 17/6/2026 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4). | |
| Modificada | Crítica (9.8) | 1.1% | — | Salesagility Suitecrm | 16/3/2020 | 17/6/2026 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4). | |
| Modificada | Crítica (9.8) | 19% | 💥 Exploit | Fasterxml Jackson-databindNetapp Active IQ Unified ManagerDebian LinuxOracle Agile Product Lifecycle Management+21 | 2/3/2020 | 25/8/2026 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core). | |
| Modificada | Crítica (9.8) | 4.6% | — | Fasterxml Jackson-databindNetapp Active IQ Unified ManagerDebian LinuxOracle Agile Product Lifecycle Management+27 | 2/3/2020 | 7/10/2026 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config). | |
| Modificada | Media (5.5) | 1.6% | — | F-secure Cloud Protection FOR SalesforceF-secure Email AND Server SecurityF-secure Internet Gatekeeper | 22/2/2020 | 17/6/2026 | The F-Secure AV parsing engine before 2020-02-05 allows virus-detection bypass via crafted Compression Method data in a GZIP archive. This affects versions before 17.0.605.474 (on Linux) of Cloud Protection For Salesforce, Email and Server Security, and Internet GateKeeper. | |
| Modificada | Media (6.5) | 1.4% | — | Salesagility Suitecrm | 13/2/2020 | 17/6/2026 | SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module. | |
| Modificada | Crítica (9.8) | 3.3% | — | Salesagility Suitecrm | 13/2/2020 | 17/6/2026 | SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list. | |
| Modificada | Crítica (9.8) | 2.6% | — | Salesagility Suitecrm | 13/2/2020 | 17/6/2026 | SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation. | |
| Modificada | Alta (7.2) | 2.8% | — | Salesagility Suitecrm | 13/2/2020 | 17/6/2026 | SuiteCRM through 7.11.11 allows PHAR Deserialization. | |
| Modificada | Alta (8.8) | 2.8% | — | Salesagility Suitecrm | 13/2/2020 | 17/6/2026 | SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection. | |
| Modificada | Crítica (9.8) | 3.0% | — | Dejavuprotech Crescendo - Sales CRM | 10/1/2020 | 17/6/2026 | Déjà Vu Crescendo Sales CRM has remote SQL Injection | |
| Modificada | Crítica (9.8) | 8.6% | — | Fasterxml Jackson-databindOracle Banking PlatformOracle Communications Billing AND Revenue ManagementOracle Communications Cloud Native Core Network Slice Selection Function+26 | 3/1/2020 | 17/6/2026 | FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. | |
| Modificada | Media (6.3) | 0.74% | — | SAP ERP SalesSAP S4hana Sales | 13/11/2019 | 17/6/2026 | Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01, 1.02, 1.03, 1.04) does not execute the required authorization checks for an authenticated user, which can result in an escalation of privileges. | |
| Modificada | Crítica (9.8) | 1.1% | — | Salesagility Suitecrm | 6/11/2019 | 17/6/2026 | SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection. | |
| Modificada | Alta (8.8) | 1.2% | — | Oxid-esales Eshop | 5/11/2019 | 17/6/2026 | An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrative rights could… | |
| Modificada | Crítica (9.8) | 14% | — | Oracle Application Testing SuiteOracle Banking Enterprise CollectionsOracle Banking Enterprise OriginationsOracle Banking Enterprise Product Manufacturing+18 | 16/10/2019 | 17/6/2026 | Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and… | |
| Modificada | Crítica (9.8) | 5.4% | — | Fasterxml Jackson-databindDebian LinuxRedhat Jboss Enterprise Application PlatformOracle Banking Platform+18 | 12/10/2019 | 17/6/2026 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide… | |
| Modificada | Crítica (9.8) | 1.5% | — | Salesagility Suitecrm | 2/10/2019 | 17/6/2026 | SuiteCRM 7.11.x and 7.10.x before 7.11.8 and 7.10.20 is vulnerable to vertical privilege escalation. | |
| Modificada | Crítica (9.8) | 1.3% | — | Salesagility Suitecrm | 2/10/2019 | 17/6/2026 | SalesAgility SuiteCRM 7.10.x 7.10.19 and 7.11.x before and 7.11.7 has SSRF. | |
| Modificada | Crítica (9.8) | 5.7% | — | Fasterxml Jackson-databindDebian LinuxFedoraproject FedoraRedhat Jboss Enterprise Application Platform+24 | 1/10/2019 | 17/6/2026 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service… | |
| Modificada | Crítica (9.8) | 4.9% | — | Fasterxml Jackson-databindDebian LinuxFedoraproject FedoraRedhat Jboss Enterprise Application Platform+22 | 1/10/2019 | 7/10/2026 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint… |