Oracle Insurance Policy Administration J2EE 11.0.2
Approved changes feed: RSS · Atom
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2:*:*:*:*:*:*:*
part: a version: 11.0.2 update: *
| Vendor | Oracle (3509f9eb-d8a0-57da-b153-b8021021b133) |
|---|---|
| Product | Insurance Policy Administration J2Ee (2b558b34-c9ec-59bc-ab46-2486517aa0b8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-5398 |
vulnerable | 2026-06-08 05:26:42.758165 |
RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
HIGH (8)
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Published: 2020-01-16T23:55:15.596Z
Updated: 2024-09-16T17:43:32.422Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5397 |
vulnerable | 2026-06-08 05:26:42.724806 |
CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux
MEDIUM (5.3)
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
Published: 2020-01-17T18:50:12.742Z
Updated: 2024-09-17T01:45:35.621Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-35491 |
vulnerable | 2026-06-08 05:25:01.183092 |
Details available
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.
Published: 2020-12-17T18:43:41.000Z
Updated: 2024-08-04T17:02:08.246Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-10683 |
vulnerable | 2026-06-08 05:16:35.580678 |
Details available
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Published: 2020-05-01T18:55:25.000Z
Updated: 2024-08-04T11:06:11.156Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-12415 |
vulnerable | 2026-06-08 05:12:39.103202 |
Details available
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
Published: 2019-10-23T19:27:20.000Z
Updated: 2024-08-04T23:17:40.071Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10219 |
vulnerable | 2026-06-08 05:12:22.710274 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.