[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmnWWV1-oHdejiSJkFBOOL1fTFKsbGKOWJqE0pzkpuBQ":3,"g5a-ex:oracle\u002Fendeca_information_discovery_studio@*":111,"g5a-family:oracle\u002Fendeca_information_discovery_studio":113},{"success":4,"data":5},true,{"product":6,"versions":24,"topVulnerabilitiesByEpss":28,"kevVulnerabilities":88,"seoMetadata":89,"meta":108},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":23},"oracle","endeca_information_discovery_studio",3,11,0,"2020-11-16",[14,18,21],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},"3.1.0",1,false,{"version":19,"cve_count":20,"kev_count":11,"has_kev":17},"3.2.0",9,{"version":22,"cve_count":9,"kev_count":11,"has_kev":17},"3.2.0.0","Endeca Information Discovery Studio by Oracle is a technology product with 3 tracked versions and 11 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[25,26,27],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},{"version":19,"cve_count":20,"kev_count":11,"has_kev":17},{"version":22,"cve_count":9,"kev_count":11,"has_kev":17},[29,37,44,49,54,59,64,72,77,82],{"cveId":30,"description":31,"publishedDate":32,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":17,"epssScore":36},"CVE-2019-10173","It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)","2019-07-23",9.8,"v3.1","Critical",0.95036,{"cveId":38,"description":39,"publishedDate":40,"cvssScore":41,"cvssVersion":34,"severity":42,"isKev":17,"epssScore":43},"CVE-2019-0227","A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.","2019-05-01",7.5,"High",0.9194,{"cveId":45,"description":46,"publishedDate":47,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":17,"epssScore":48},"CVE-2017-5645","In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","2017-04-17",0.89792,{"cveId":50,"description":51,"publishedDate":12,"cvssScore":52,"cvssVersion":34,"severity":42,"isKev":17,"epssScore":53},"CVE-2020-26217","XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.",8,0.85001,{"cveId":55,"description":56,"publishedDate":57,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":17,"epssScore":58},"CVE-2013-7285","Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","2019-05-15",0.84362,{"cveId":60,"description":61,"publishedDate":62,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":17,"epssScore":63},"CVE-2019-17571","Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.","2019-12-20",0.6998,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":68,"cvssVersion":69,"severity":70,"isKev":17,"epssScore":71},"CVE-2015-9251","jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text\u002Fjavascript responses to be executed.","2018-01-18",6.1,"v3.0","Medium",0.29726,{"cveId":73,"description":74,"publishedDate":75,"cvssScore":68,"cvssVersion":34,"severity":70,"isKev":17,"epssScore":76},"CVE-2018-8032","Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet\u002Fservices.","2018-08-02",0.10554,{"cveId":78,"description":79,"publishedDate":80,"cvssScore":41,"cvssVersion":34,"severity":42,"isKev":17,"epssScore":81},"CVE-2020-11979","As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.","2020-10-01",0.08016,{"cveId":83,"description":84,"publishedDate":85,"cvssScore":86,"cvssVersion":34,"severity":70,"isKev":17,"epssScore":87},"CVE-2020-1945","Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.","2020-05-14",6.3,0.01769,[],{"title":90,"metaDescription":91,"keywords":92,"structuredData":93},"Endeca Information Discovery Studio by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Endeca Information Discovery Studio by Oracle covering 3 versions with 11 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Endeca Information Discovery Studio vulnerabilities, Endeca Information Discovery Studio security, Endeca Information Discovery Studio CVE, Oracle Endeca Information Discovery Studio, Endeca Information Discovery Studio threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":94,"@type":95,"name":96,"description":91,"url":97,"manufacturer":98,"applicationCategory":102,"softwareVersion":103,"mainEntity":104},"https:\u002F\u002Fschema.org","SoftwareApplication","Endeca Information Discovery Studio","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fendeca_information_discovery_studio",{"@type":99,"name":100,"url":101},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","3 versions tracked",{"@type":105,"name":106,"description":107,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Endeca Information Discovery Studio Security Vulnerabilities","Security vulnerabilities affecting Endeca Information Discovery Studio by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":109,"apiVersion":110},"2026-10-18T18:55:55.379Z","3.0",{"rows":112,"total":11,"capped":17,"failed":11},[],[]]