# Oracle Primavera P6 Enterprise Project Portfolio Management


- [CVE-2017-3324](https://insights.sbomify.com/CVE-2017-3324/): Missing authorization in Primavera P6 Enterprise Project Portfolio Management (critical 10.0)
- [CVE-2017-3503](https://insights.sbomify.com/CVE-2017-3503/): Deserialization in Primavera P6 Enterprise Project Portfolio Management (critical 9.9)
- [CVE-2020-10683](https://insights.sbomify.com/CVE-2020-10683/): dom4j allows External Entities by default which might enable XXE attacks (critical 9.8)
- [CVE-2018-14718](https://insights.sbomify.com/CVE-2018-14718/): Arbitrary Code Execution in jackson-databind (critical 9.8)
- [CVE-2018-14719](https://insights.sbomify.com/CVE-2018-14719/): Arbitrary Code Execution in jackson-databind (critical 9.8)
- [CVE-2018-19360](https://insights.sbomify.com/CVE-2018-19360/): Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization (critical 9.8)
- [CVE-2018-19361](https://insights.sbomify.com/CVE-2018-19361/): Deserialization of Untrusted Data in jackson-databind (critical 9.8)
- [CVE-2018-19362](https://insights.sbomify.com/CVE-2018-19362/): com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data (critical 9.8)
- [CVE-2019-3020](https://insights.sbomify.com/CVE-2019-3020/): Cross-site scripting in Primavera P6 Enterprise Project Portfolio Management (critical 9.3)
- [CVE-2016-0635](https://insights.sbomify.com/CVE-2016-0635/): Other in n/a (high 8.8)
- [CVE-2020-5421](https://insights.sbomify.com/CVE-2020-5421/): RFD Protection Bypass via jsessionid (high 8.7)
- [CVE-2021-2351](https://insights.sbomify.com/CVE-2021-2351/): Weak cryptography in WebLogic Server (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/primavera-p6-enterprise-project-portfolio-management/