Latest oracle communications application session controller Vulnerabilities

● CVE-2021-2351

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unau...

Oracle Advanced Networking Option=12.1.0.2

Oracle Advanced Networking Option=12.2.0.1

Oracle Advanced Networking Option=19c

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

Oracle Agile Product Lifecycle Management for Process=6.2.2.0

and 242 more

● CVE-2021-29425

Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the FileNameUtils.normalize method. An attacker could send a specially-cra...

redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea

redhat/eap7-jberet<0:1.3.9-1.Final_redhat_00001.1.el6ea

and 185 more

● CVE-2020-11987

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulner...

Apache Batik<=1.13

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Oracle Banking Apis=18.3

Oracle Banking Apis=19.1

Oracle Banking Apis=19.2

and 38 more

● CVE-2020-28052

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect pass...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api=1.65

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api=1.66

Apache Karaf=4.3.2

Oracle Banking Corporate Lending Process Management=14.2.0

Oracle Banking Corporate Lending Process Management=14.3.0

Oracle Banking Corporate Lending Process Management=14.5.0

and 81 more

● CVE-2020-27216

### Impact On Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the sh...

redhat/rh-eclipse<1:4.17-6.el7_9

redhat/rh-eclipse-ant<0:1.10.9-1.2.el7

redhat/rh-eclipse-antlr32<0:3.2-28.1.el7

redhat/rh-eclipse-apache-sshd<1:2.4.0-5.1.el7

redhat/rh-eclipse-apiguardian<0:1.1.0-6.1.el7

redhat/rh-eclipse-args4j<0:2.33-12.2.el7

and 108 more

● CVE-2019-17566

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vul...

maven/org.apache.xmlgraphics:batik<1.13

Apache Batik<1.13

Oracle API Gateway=11.1.2.4.0

Oracle Business Intelligence=5.5.0.0.0

Oracle Business Intelligence=5.9.0.0.0

Oracle Business Intelligence=12.2.1.3.0

and 26 more

● CVE-2020-9488

Apache Log4j is vulnerable to a man-in-the-middle attack, caused by improper certificate validation with host mismatch in the SMTP appender. An attacker could exploit this vulnerability to launch a ma...

debian/apache-log4j2

redhat/qpid-cpp<0:1.36.0-31.el6_10a

redhat/qpid-proton<0:0.32.0-1.el6_10

redhat/qpid-cpp<0:1.36.0-31.el7a

redhat/qpid-proton<0:0.32.0-2.el7

redhat/nodejs-rhea<0:1.0.24-1.el8

and 110 more

● CVE-2020-11022

### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patch...

rubygems/jquery-rails<4.4.0

maven/org.webjars.npm:jquery>=1.2.0<3.5.0

nuget/jquery>=1.2.0<3.5.0

npm/jquery>=1.2.0<3.5.0

redhat/qpid-dispatch<0:1.13.0-3.el6_10

redhat/qpid-dispatch<0:1.13.0-3.el7

and 164 more

● CVE-2020-5258

Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values, an attacker could exploit this vulnerability to overwri...

IBM Financial Transaction Manager for Corporate Payment Services for Multi-Platform<=3.2.0-3.2.9

IBM Financial Transaction Manager for Digital Payments for Multi-Platform<=3.2.0-3.2.9

IBM Financial Transaction Manager for High Value Payments for Multi-Platform<=3.2.0-3.2.10.2

Linuxfoundation Dojo<1.11.10

Linuxfoundation Dojo>=1.12.0<1.12.8

Linuxfoundation Dojo>=1.13.0<1.13.7

and 21 more

● CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 779 more

● CVE-2020-10683

dom4j could allow a remote authenticated attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data. By sending specially crafted XML data, a remot...

redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea

redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea

redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el6ea

and 204 more

● CVE-2019-11358

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted J...

redhat/ansible-tower<0:3.5.2-1.el7a

redhat/cfme<0:5.10.9.1-1.el7cf

redhat/cfme-amazon-smartstate<0:5.10.9.1-1.el7cf

redhat/cfme-appliance<0:5.10.9.1-1.el7cf

redhat/cfme-gemset<0:5.10.9.1-1.el7cf

redhat/ovirt-ansible-hosted-engine-setup<0:1.0.23-1.el7e

and 267 more

● CVE-2018-11784

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/fo...

Apache Tomcat>=7.0.23<=7.0.90

Apache Tomcat>=8.5.0<=8.5.33

Apache Tomcat>=9.0.1<=9.0.11

Apache Tomcat=9.0.0

Apache Tomcat=9.0.0-m1

Apache Tomcat=9.0.0-m10

and 87 more

● CVE-2018-1000613

Legion of the Bouncy Castle Java Cryptography APIs could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe reflection flaw in XMSS/XMSS^MT private key deserializatio...

maven/org.bouncycastle:bcprov-jdk15on>=1.57<1.60

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api>=1.58<1.60

NetApp OnCommand Workflow Automation

openSUSE Leap=15.1

Oracle API Gateway=11.1.2.4.0

Oracle Banking Platform=2.6.0

and 89 more

● CVE-2018-1000180

Bouncy Castle could provide weaker than expected security, caused by an error in the Low-level interface to RSA key pair generator. The RSA Key Pairs generated in low-level API with added certainty ma...

Bouncycastle Fips Java Api<=1.0.1

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api>=1.54<=1.59

Debian Debian Linux=9.0

Oracle API Gateway=11.1.2.4.0

Oracle Business Process Management Suite=11.1.1.9.0

Oracle Business Process Management Suite=12.1.3.0.0

and 26 more

Latest oracle communications application session controller Vulnerabilities

Company

Resources

Contact