[
  {"cve_id":"CVE-2021-44548","description":"An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.","exploit_maturity":"No public exploit","published":"2021-12-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-43113","description":"iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.","exploit_maturity":"No public exploit","published":"2021-12-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-45046","description":"It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.","exploit_maturity":"Exploited in the wild","published":"2021-12-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-43821","description":"Opencast is an Open Source Lecture Capture \u0026 Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface. Before Opencast 9.10 and 10.6, Opencast would open and include local files during ingests. Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine. An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given. The issue has been fixed in Opencast 10.6 and 11.0. You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating.","exploit_maturity":"No public exploit","published":"2021-12-14","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-44228","description":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","exploit_maturity":"Exploited in the wild","published":"2021-12-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-23463","description":"The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.","exploit_maturity":"No public exploit","published":"2021-12-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-23264","description":"Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.","exploit_maturity":"No public exploit","published":"2021-12-02","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-44140","description":"Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.","exploit_maturity":"No public exploit","published":"2021-11-24","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-39233","description":"In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.","exploit_maturity":"No public exploit","published":"2021-11-19","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-39231","description":"In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.","exploit_maturity":"No public exploit","published":"2021-11-19","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-36372","description":"In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.","exploit_maturity":"No public exploit","published":"2021-11-19","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-37580","description":"A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0","exploit_maturity":"Working exploit published","published":"2021-11-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2021-41269","description":"cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.","exploit_maturity":"No public exploit","published":"2021-11-15","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-43570","description":"The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.","exploit_maturity":"No public exploit","published":"2021-11-09","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-43466","description":"In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.","exploit_maturity":"No public exploit","published":"2021-11-09","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21697","description":"Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21696","description":"Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant. This results in unsandboxed code execution in the Jenkins controller process.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21694","description":"FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21693","description":"When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21692","description":"FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21691","description":"Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21690","description":"Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21689","description":"FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21687","description":"Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21685","description":"Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.","exploit_maturity":"No public exploit","published":"2021-11-04","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-40865","description":"An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4","exploit_maturity":"Proof of concept only","published":"2021-10-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-38294","description":"A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.","exploit_maturity":"Forecast only","published":"2021-10-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-35652","description":"Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported versions that are affected are Prior to 11.1.2.4.046 and Prior to 21.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Essbase Administration Services. While the vulnerability is in Essbase Administration Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Essbase Administration Services. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-10-20","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-35617","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-10-20","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-42575","description":"The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.","exploit_maturity":"No public exploit","published":"2021-10-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-3878","description":"corenlp is vulnerable to Improper Restriction of XML External Entity Reference","exploit_maturity":"No public exploit","published":"2021-10-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-42013","description":"It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.","exploit_maturity":"Exploited in the wild","published":"2021-10-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-41773","description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","exploit_maturity":"Exploited in the wild","published":"2021-10-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-41862","description":"AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).","exploit_maturity":"No public exploit","published":"2021-10-02","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-41616","description":"Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was insecure and used ObjectInputStream.readObject without validating that the input data was safe to deserialize. Please note that DdlUtils is no longer being actively developed. To address the insecurity of the BinaryObjectHelper class, the following changes to DdlUtils have been made: (1) BinaryObjectsHelper.java has been deleted from the DdlUtils source repository and the DdlUtils feature of propagating data of SQL binary types is therefore no longer present in DdlUtils; (2) The ddlutils-1.0 release has been removed from the Apache Release Distribution Infrastructure; (3) The DdlUtils web site has been updated to indicate that DdlUtils is now available only as source code, not as a packaged release.","exploit_maturity":"No public exploit","published":"2021-09-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-41303","description":"Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.","exploit_maturity":"Forecast only","published":"2021-09-17","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2020-21125","description":"An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.","exploit_maturity":"No public exploit","published":"2021-09-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-23440","description":"This affects the package set-value before \u003c2.0.1, \u003e=3.0.0 \u003c4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","exploit_maturity":"No public exploit","published":"2021-09-12","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-40146","description":"A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions \u003c 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class of arbitrary code execution (ACE) vulnerabilities.","exploit_maturity":"No public exploit","published":"2021-09-11","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-38555","description":"An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions \u003c 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.","exploit_maturity":"No public exploit","published":"2021-09-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-37579","description":"The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.","exploit_maturity":"No public exploit","published":"2021-09-09","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-36161","description":"Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13","exploit_maturity":"No public exploit","published":"2021-09-09","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-36163","description":"In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1","exploit_maturity":"No public exploit","published":"2021-09-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-10095","description":"bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.","exploit_maturity":"No public exploit","published":"2021-09-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-39185","description":"Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.","exploit_maturity":"No public exploit","published":"2021-09-01","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-39177","description":"Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading.","exploit_maturity":"No public exploit","published":"2021-08-30","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-32827","description":"MockServer is open source software which enables easy mocking of any system you integrate with via HTTP or HTTPS. An attacker that can trick a victim into visiting a malicious site while running MockServer locally, will be able to run arbitrary code on the MockServer machine. With an overly broad default CORS configuration MockServer allows any site to send cross-site requests. Additionally, MockServer allows you to create dynamic expectations using Javascript or Velocity templates. Both engines may allow an attacker to execute arbitrary code on-behalf of MockServer. By combining these two issues (Overly broad CORS configuration + Script injection), an attacker could serve a malicious page so that if a developer running MockServer visits it, they will get compromised. For more details including a PoC see the referenced GHSL-2021-059.","exploit_maturity":"No public exploit","published":"2021-08-16","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2020-28088","description":"An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code.","exploit_maturity":"No public exploit","published":"2021-08-06","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-34371","description":"Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.","exploit_maturity":"Proof of concept only","published":"2021-08-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-37578","description":"Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicious serialized object to the above RMI entries. The objects get deserialized without any check on the incoming data. In the worst case, it may let the attacker run arbitrary code remotely. For both jUDDI web service applications and jUDDI clients, the usage of RMI is disabled by default. Since this is an optional feature and an extension to the UDDI protocol, the likelihood of impact is low. Starting with 3.3.10, all RMI related code was removed.","exploit_maturity":"No public exploit","published":"2021-07-29","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-2463","description":"Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that are affected are 11.0.0, 11.1.0, 11.2.0 and 11.3.0-11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-07-21","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2456","description":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2021-07-21","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2397","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-07-21","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2394","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2021-07-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-2382","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-07-21","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2355","description":"Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Marketing accessible data as well as unauthorized access to critical data or complete access to all Oracle Marketing accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"No public exploit","published":"2021-07-21","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-29485","description":"Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE) via a maliciously crafted Java deserialization gadget chain leveraged against the Ratpack session store. If one's application does not use Ratpack's session mechanism, it is not vulnerable. Ratpack 1.9.0 introduces a strict allow-list mechanism that mitigates this vulnerability when used. Two possible workarounds exist. The simplest mitigation for users of earlier versions is to reduce the likelihood of attackers being able to write to the session data store. Alternatively or additionally, the allow-list mechanism could be manually back ported by providing an alternative implementation of `SessionSerializer` that uses an allow-list.","exploit_maturity":"No public exploit","published":"2021-06-29","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-31649","description":"In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute","exploit_maturity":"No public exploit","published":"2021-06-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21669","description":"Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2021-06-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-9493","description":"A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.","exploit_maturity":"No public exploit","published":"2021-06-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-3520","description":"There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.","exploit_maturity":"No public exploit","published":"2021-06-02","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-30181","description":"Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.","exploit_maturity":"Forecast only","published":"2021-06-01","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-30180","description":"Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.","exploit_maturity":"Forecast only","published":"2021-06-01","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-30179","description":"Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.","exploit_maturity":"No public exploit","published":"2021-06-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-25641","description":"Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.","exploit_maturity":"Proof of concept only","published":"2021-06-01","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-20195","description":"A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","exploit_maturity":"No public exploit","published":"2021-05-28","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-22160","description":"If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to \"none\". This allows an attacker to connect to Pulsar instances as any user (incl. admins).","exploit_maturity":"Forecast only","published":"2021-05-26","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21658","description":"Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","exploit_maturity":"No public exploit","published":"2021-05-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-35198","description":"An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.","exploit_maturity":"No public exploit","published":"2021-05-12","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-26077","description":"Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions 1.1.0 before 2.1.3 and versions 2.1.4 before 2.1.5 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.","exploit_maturity":"No public exploit","published":"2021-05-10","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21428","description":"Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.","exploit_maturity":"No public exploit","published":"2021-05-10","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-29441","description":"Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.","exploit_maturity":"Working exploit published","published":"2021-04-27","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2021-2302","description":"Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: OPSS). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2021-04-22","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2253","description":"Vulnerability in the Oracle Advanced Supply Chain Planning product of Oracle Supply Chain (component: Core). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Supply Chain Planning. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Advanced Supply Chain Planning accessible data as well as unauthorized access to critical data or complete access to all Oracle Advanced Supply Chain Planning accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"No public exploit","published":"2021-04-22","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2244","description":"Vulnerability in the Hyperion Analytic Provider Services product of Oracle Hyperion (component: JAPI) and Essbase Analytic Provider Services product of Oracle Essbase (component: JAPI). Supported versions that are affected are Hyperion Analytic Provider Services 11.1.2.4 and 12.2.1.4, and Essbase Analytic Provider Services 21.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Analytic Provider Services. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Hyperion Analytic Provider Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Hyperion Analytic Provider Services. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-04-22","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2205","description":"Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2.7-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Marketing accessible data as well as unauthorized access to critical data or complete access to all Oracle Marketing accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"No public exploit","published":"2021-04-22","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2200","description":"Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Home page). The supported version that is affected is 12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Framework accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"No public exploit","published":"2021-04-22","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2136","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-04-22","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2135","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2021-04-22","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-29459","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to persistently inject scripts in XWiki versions prior to 12.6.3 and 12.8. Unregistred users can fill simple text fields. Registered users can fill in their personal information and (if they have edit rights) fill the values of static lists using App Within Minutes. There is no easy workaround except upgrading XWiki. The vulnerability has been patched on XWiki 12.8 and 12.6.3.","exploit_maturity":"No public exploit","published":"2021-04-20","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-29451","description":"Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. The issue will be patched in the upcoming 5.2.1 release.","exploit_maturity":"No public exploit","published":"2021-04-16","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-27850","description":"A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.","exploit_maturity":"Working exploit published","published":"2021-04-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-29943","description":"When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.","exploit_maturity":"No public exploit","published":"2021-04-13","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-27905","description":"The ReplicationHandler (normally registered at \"/replication\" under a Solr core) in Apache Solr has a \"masterUrl\" (also \"leaderUrl\" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the \"shards\" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.","exploit_maturity":"Working exploit published","published":"2021-04-13","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2021-26715","description":"The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network.","exploit_maturity":"No public exploit","published":"2021-03-25","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21783","description":"A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.","exploit_maturity":"No public exploit","published":"2021-03-25","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-21350","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"No public exploit","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21347","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"No public exploit","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21345","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"Working exploit published","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21344","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"Forecast only","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-21342","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"No public exploit","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-10196","description":"A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.","exploit_maturity":"No public exploit","published":"2021-03-19","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-26987","description":"Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.","exploit_maturity":"No public exploit","published":"2021-03-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-36282","description":"JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.","exploit_maturity":"No public exploit","published":"2021-03-12","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-27582","description":"org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in which HTTP request parameters affect an authorizationRequest.","exploit_maturity":"No public exploit","published":"2021-02-23","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2021-21479","description":"In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.","exploit_maturity":"Working exploit published","published":"2021-02-09","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-17523","description":"Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.","exploit_maturity":"Proof of concept only","published":"2021-02-03","resolved":"NO-EXPLOIT-PUBLISHED","severity":"Critical"},
  {"cve_id":"CVE-2020-23262","description":"An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.","exploit_maturity":"No public exploit","published":"2021-01-26","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-23901","description":"An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions \u003c 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Nutch 1.18.","exploit_maturity":"No public exploit","published":"2021-01-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-8570","description":"Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.","exploit_maturity":"No public exploit","published":"2021-01-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-2108","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). The supported version that is affected is 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-01-20","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2101","description":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Print Server). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle One-to-One Fulfillment accessible data as well as unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"No public exploit","published":"2021-01-20","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2100","description":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Print Server). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle One-to-One Fulfillment accessible data as well as unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"No public exploit","published":"2021-01-20","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2075","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-01-20","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2064","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). The supported version that is affected is 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-01-20","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2047","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-01-20","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-2029","description":"Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in takeover of Oracle Scripting. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"No public exploit","published":"2021-01-20","resolved":"NO-FIX-IDENTIFIED","severity":"Critical"},
  {"cve_id":"CVE-2021-1994","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2021-01-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-14756","description":"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Proof of concept only","published":"2021-01-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-23926","description":"The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.","exploit_maturity":"No public exploit","published":"2021-01-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-23899","description":"OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.","exploit_maturity":"No public exploit","published":"2021-01-13","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-11995","description":"A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.","exploit_maturity":"No public exploit","published":"2021-01-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-17519","description":"A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.","exploit_maturity":"Exploited in the wild","published":"2021-01-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"}
]