Oracle: >> Jd Edwards Enterpriseone Tools >> 9.2.5.0 Security Vulnerabilities
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
CVSS Score
6.1
EPSS Score
0.007
Published
2020-03-07
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
CVSS Score
9.8
EPSS Score
0.123
Published
2019-10-15
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVSS Score
7.3
EPSS Score
0.003
Published
2019-08-20
Page 9