CVE-2016-5019 in Oracle Rapid Planning

Summary

CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string.

Reservation

05/24/2016

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
158464	Oracle Rapid Planning Middle Tier deserialization	502	Not defined	Official fix	CVE-2016-5019
148942	Oracle Retail Clearance Optimization Engine General Application deserialization	502	Not defined	Official fix	CVE-2016-5019
148941	Oracle Retail Clearance Optimization Engine Dataset deserialization	502	Not defined	Official fix	CVE-2016-5019
125383	Oracle Communications Performance Intelligence Center (PIC) Software Apache Trinidad deserialization	502	Not defined	Official fix	CVE-2016-5019
121886	Oracle Utilities Framework Help deserialization	502	Not defined	Official fix	CVE-2016-5019
116669	Oracle Fusion Middleware MapViewer Tile Server deserialization	502	Not defined	Official fix	CVE-2016-5019
108011	Oracle Communications Services Gatekeeper Apache Trinidad deserialization	502	Not defined	Official fix	CVE-2016-5019
103995	Oracle Primavera P6 Enterprise Project Portfolio Management Apache Trinidad deserialization	502	Not defined	Official fix	CVE-2016-5019
100160	Oracle StorageTek Tape Analytics SW Tool Apache Trinidad deserialization	502	Not defined	Official fix	CVE-2016-5019
100136	Oracle Utilities Customer Self Service Packaging deserialization	502	Not defined	Official fix	CVE-2016-5019
95574	Oracle Enterprise Manager deserialization	502	Not defined	Official fix	CVE-2016-5019
95573	Oracle Enterprise Manager Application Testing Suite deserialization	502	Not defined	Official fix	CVE-2016-5019
92314	Apache MyFaces Trinidad CoreResponseStateManager deserialization	502	Not defined	Official fix	CVE-2016-5019