Latest oracle banking digital experience Vulnerabilities

● CVE-2021-41165

### Affected packages The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. ### Impact A potential vulnerability has been discovered ...

Ckeditor Ckeditor<4.17.0

Drupal Drupal>=8.9.0<8.9.20

Drupal Drupal>=9.1.0<9.1.14

Drupal Drupal>=9.2.0<9.2.9

Oracle Agile Product Lifecycle Management=9.3.6

Oracle Application Express<22.1

and 19 more

● CVE-2021-41164

CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The...

Ckeditor Ckeditor>=4.0<4.17.0

Drupal Drupal>=8.9.0<8.9.20

Drupal Drupal>=9.1.0<9.1.14

Drupal Drupal>=9.2.0<9.2.9

Oracle Banking Apis>=18.1<=18.3

Oracle Banking Apis=19.1

and 19 more

● CVE-2021-37137

### Impact The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk ...

redhat/eap7-netty<0:4.1.72-4.Final_redhat_00001.1.el8ea

redhat/eap7-netty<0:4.1.72-4.Final_redhat_00001.1.el7ea

redhat/candlepin<0:4.1.15-1.el8

maven/io.netty:netty<4.0.0

maven/org.jboss.netty:netty<4.0.0

maven/io.netty:netty-codec>=4.0.0<4.1.68.Final

and 61 more

● CVE-2021-37136

### Impact The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users o...

maven/io.netty:netty<4.0.0

maven/org.jboss.netty:netty<4.0.0

maven/io.netty:netty-codec<4.1.68.Final

Netty Netty<4.1.68

Quarkus Quarkus<2.2.4

Oracle Banking Apis>=18.1<=18.3

and 44 more

● CVE-2021-2351

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unau...

Oracle Advanced Networking Option=12.1.0.2

Oracle Advanced Networking Option=12.2.0.1

Oracle Advanced Networking Option=19c

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

Oracle Agile Product Lifecycle Management for Process=6.2.2.0

and 242 more

● CVE-2021-36090

A flaw was found in apache-commons-compress. When reading a specially crafted ZIP archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This fla...

redhat/apache-commons-compress<0:1.21-1.2.el8e

IBM Cloud Pak System<=V2.3.0 - V2.3.3.3 Interim Fix 1

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.0<1.21

Oracle Banking Apis>=18.1<=18.3

Oracle Banking Apis=19.1

and 69 more

● CVE-2021-35515

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This flaw allo...

redhat/apache-commons-compress<0:1.21-1.2.el8e

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.6<=1.20

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vmware Vsphere

Netapp Active Iq Unified Manager Windows

and 43 more

● CVE-2021-35517

A flaw was found in apache-commons-compress. When reading a specially crafted TAR archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This fla...

redhat/apache-commons-compress<0:1.21-1.2.el8e

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.1<=1.20

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vmware Vsphere

Netapp Active Iq Unified Manager Windows

and 50 more

● CVE-2021-35516

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for very small inputs. This...

redhat/apache-commons-compress<0:1.21-1.2.el8e

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.6<=1.20

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vmware Vsphere

Netapp Active Iq Unified Manager Windows

and 43 more

● CVE-2021-29425

Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the FileNameUtils.normalize method. An attacker could send a specially-cra...

redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea

redhat/eap7-jberet<0:1.3.9-1.Final_redhat_00001.1.el6ea

and 185 more

● CVE-2021-28163

Eclipse Jetty could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw when the ${jetty.base} directory or the ${jetty.base}/webapps directory is a symlink. By sen...

redhat/rh-eclipse-jetty<0:9.4.40-1.1.el7_9

redhat/jenkins<0:2.277.3.1620393611-1.el8

redhat/runc<0:1.0.0-95.rhaos4.8.gitcd80260.el8

redhat/jetty<9.4.39

redhat/jetty<10.0.2

redhat/jetty<11.0.2

and 33 more

● CVE-2021-28164

Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by improper input validation by the default compliance mode. By sending specially-crafted requests with URIs that co...

redhat/rh-eclipse-jetty<0:9.4.40-1.1.el7_9

redhat/jetty<9.4.39

Eclipse Jetty=9.4.37-20210219

Eclipse Jetty=9.4.38-20210224

NetApp Cloud Manager

Netapp E-series Performance Analyzer

and 16 more

● CVE-2020-11987

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulner...

Apache Batik<=1.13

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Oracle Banking Apis=18.3

Oracle Banking Apis=19.1

Oracle Banking Apis=19.2

and 38 more

● CVE-2020-14195

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing. The highest threat from this vul...

redhat/candlepin<0:2.6.16-1.el7

redhat/foreman<0:1.22.0.39-2.el7

redhat/satellite<0:6.6.3-1.el7

redhat/tfm-rubygem-fog-ovirt<0:1.2.3-1.el7

redhat/tfm-rubygem-katello<0:3.12.0.41-1.el7

redhat/tfm-rubygem-runcible<0:2.13.0-1.el7

and 311 more

● CVE-2020-14061

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this...

redhat/candlepin<0:2.6.16-1.el7

redhat/foreman<0:1.22.0.39-2.el7

redhat/satellite<0:6.6.3-1.el7

redhat/tfm-rubygem-fog-ovirt<0:1.2.3-1.el7

redhat/tfm-rubygem-katello<0:3.12.0.41-1.el7

redhat/tfm-rubygem-runcible<0:2.13.0-1.el7

and 311 more

● CVE-2020-14060

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data co...

redhat/candlepin<0:2.6.16-1.el7

redhat/foreman<0:1.22.0.39-2.el7

redhat/satellite<0:6.6.3-1.el7

redhat/tfm-rubygem-fog-ovirt<0:1.2.3-1.el7

redhat/tfm-rubygem-katello<0:3.12.0.41-1.el7

redhat/tfm-rubygem-runcible<0:2.13.0-1.el7

and 30 more

● CVE-2020-14062

redhat/candlepin<0:2.6.16-1.el7

redhat/foreman<0:1.22.0.39-2.el7

redhat/satellite<0:6.6.3-1.el7

redhat/tfm-rubygem-fog-ovirt<0:1.2.3-1.el7

redhat/tfm-rubygem-katello<0:3.12.0.41-1.el7

redhat/tfm-rubygem-runcible<0:2.13.0-1.el7

and 309 more

● CVE-2020-11022

### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patch...

rubygems/jquery-rails<4.4.0

maven/org.webjars.npm:jquery>=1.2.0<3.5.0

nuget/jquery>=1.2.0<3.5.0

npm/jquery>=1.2.0<3.5.0

redhat/qpid-dispatch<0:1.13.0-3.el6_10

redhat/qpid-dispatch<0:1.13.0-3.el7

and 164 more

● CVE-2020-11113

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data co...

redhat/qpid-cpp<0:1.36.0-31.el6_10a

redhat/qpid-proton<0:0.32.0-1.el6_10

redhat/qpid-cpp<0:1.36.0-31.el7a

redhat/qpid-proton<0:0.32.0-2.el7

redhat/nodejs-rhea<0:1.0.24-1.el8

redhat/qpid-proton<0:0.32.0-2.el8

and 59 more

● CVE-2020-11112

FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization in org.apache.commons.proxy.provider.remoting.RmiProvider (aka apa...

redhat/Jackson-databind<2.9.10.4

redhat/rh-maven35-jackson-databind<0:2.7.6-2.9.el7

IBM Data Risk Manager<=2.0.6

FasterXML jackson-databind>=2.9.0<2.9.10.4

Debian Debian Linux=8.0

Netapp Steelstore Cloud Integrated Storage

and 51 more

● CVE-2020-11111

FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization in org.apache.activemq.* (aka activemq-jms, activemq-core, activem...

redhat/Jackson-databind<2.9.10.4

redhat/rh-maven35-jackson-databind<0:2.7.6-2.9.el7

IBM Data Risk Manager<=2.0.6

FasterXML jackson-databind>=2.9.0<2.9.10.4

Debian Debian Linux=8.0

Netapp Steelstore Cloud Integrated Storage

and 39 more

● CVE-2020-10968

A flaw was found in jackson-databind 2.x prior to version 2.9.10.4. The interaction between serialization gadgets and typing is mishandled in the bus-proxy. The highest threat from this vulnerability...

redhat/candlepin<0:2.6.16-1.el7

redhat/foreman<0:1.22.0.39-2.el7

redhat/satellite<0:6.6.3-1.el7

redhat/tfm-rubygem-fog-ovirt<0:1.2.3-1.el7

redhat/tfm-rubygem-katello<0:3.12.0.41-1.el7

redhat/tfm-rubygem-runcible<0:2.13.0-1.el7

and 345 more

● CVE-2020-10673

FasterXML jackson-databind 2.x before 2.9.10.4 and 2.6.7.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

maven/com.fasterxml.jackson.core:jackson-databind>=2.0.0<2.6.7.4

maven/com.fasterxml.jackson.core:jackson-databind>=2.7.0<2.9.10.4

redhat/Jackson-databind<2.9.10.4

redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea

redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea

and 161 more

● CVE-2020-10672

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this...

redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea

redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea

redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el6ea

and 159 more

● CVE-2020-10969

FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization in javax.swing.JEditorPane. By sending specially-crafted input, an...

redhat/candlepin<0:2.6.16-1.el7

redhat/foreman<0:1.22.0.39-2.el7

redhat/satellite<0:6.6.3-1.el7

redhat/tfm-rubygem-fog-ovirt<0:1.2.3-1.el7

redhat/tfm-rubygem-katello<0:3.12.0.41-1.el7

redhat/tfm-rubygem-runcible<0:2.13.0-1.el7

and 345 more

● CVE-2020-9546

redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea

redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea

redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el6ea

and 576 more

● CVE-2020-9548

A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data conf...

redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea

redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea

redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el6ea

and 566 more

● CVE-2019-3019

Vulnerability in the Oracle Banking Digital Experience product of Oracle Financial Services Applications (component: Loan Calculator). Supported versions that are affected are 18.1, 18.2, 18.3 and 19....

Oracle Banking Digital Experience=18.1

Oracle Banking Digital Experience=18.2

Oracle Banking Digital Experience=18.3

Oracle Banking Digital Experience=19.1

● CVE-2019-17495

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltrat...

Smartbear Swagger Ui<3.23.11

Oracle Banking Apis>=18.1<=18.3

Oracle Banking Apis=19.1

Oracle Banking Apis=19.2

Oracle Banking Apis=20.1

Oracle Banking Apis=21.1

and 11 more

● CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 779 more

● CVE-2019-11358

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted J...

redhat/ansible-tower<0:3.5.2-1.el7a

redhat/cfme<0:5.10.9.1-1.el7cf

redhat/cfme-amazon-smartstate<0:5.10.9.1-1.el7cf

redhat/cfme-appliance<0:5.10.9.1-1.el7cf

redhat/cfme-gemset<0:5.10.9.1-1.el7cf

redhat/ovirt-ansible-hosted-engine-setup<0:1.0.23-1.el7e

and 267 more

Latest oracle banking digital experience Vulnerabilities

Company

Resources

Contact