Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2976▼ 107 respecto a la semana anterior

Críticas / altas1449▲ 87 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)350▼ 160 respecto a la semana anterior

4 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2019-12415	Modificada	Media (5.5)	1.00%	—	Apache POI Oracle Application Testing Suite Oracle Banking Enterprise Originations Oracle Banking Enterprise Product Manufacturing+23	23/10/2019	17/6/2026	In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
CVE-2019-2904	Modificada	Crítica (9.8)	14%	—	Oracle Application Testing Suite Oracle Banking Enterprise Collections Oracle Banking Enterprise Originations Oracle Banking Enterprise Product Manufacturing+18	16/10/2019	17/6/2026	Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and…
CVE-2019-17091	Modificada	Media (6.1)	2.5%	—	Eclipse Mojarra Oracle Mojarra Javaserver Faces Oracle Application Testing Suite Oracle Banking Enterprise Product Manufacturing+19	2/10/2019	17/6/2026	faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
CVE-2019-13990	Modificada	Crítica (9.8)	16%	💥 PoC	Softwareag Quartz Oracle Apache Batik Mapviewer Oracle Banking Enterprise Originations Oracle Banking Enterprise Product Manufacturing+27	26/7/2019	17/6/2026	initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.