# Oracle Primavera Unifier


- [CVE-2019-17558](https://insights.sbomify.com/CVE-2019-17558/): Apache Solr VelocityResponseWriter Plug-In Remote Code Execution (high 7.5, exploited in the wild)
- [CVE-2018-14721](https://insights.sbomify.com/CVE-2018-14721/): Server-Side Request Forgery (SSRF) in jackson-databind (critical 10.0)
- [CVE-2021-42575](https://insights.sbomify.com/CVE-2021-42575/): Policies not properly enforced in OWASP Java HTML Sanitizer (critical 9.8)
- [CVE-2020-25020](https://insights.sbomify.com/CVE-2020-25020/): Improper Restriction of XML External Entity Reference in MPXJ (critical 9.8)
- [CVE-2020-9546](https://insights.sbomify.com/CVE-2020-9546/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2020-9547](https://insights.sbomify.com/CVE-2020-9547/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2020-9548](https://insights.sbomify.com/CVE-2020-9548/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2019-20330](https://insights.sbomify.com/CVE-2019-20330/): Deserialization of Untrusted Data in jackson-databind (critical 9.8)
- [CVE-2019-16942](https://insights.sbomify.com/CVE-2019-16942/): Polymorphic Typing in FasterXML jackson-databind (critical 9.8)
- [CVE-2019-14540](https://insights.sbomify.com/CVE-2019-14540/): Polymorphic Typing issue in FasterXML jackson-databind (critical 9.8)
- [CVE-2019-14379](https://insights.sbomify.com/CVE-2019-14379/): Deserialization of untrusted data in FasterXML jackson-databind (critical 9.8)
- [CVE-2019-13990](https://insights.sbomify.com/CVE-2019-13990/): XML external entity injection in Terracotta Quartz Scheduler (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/primavera-unifier/