Latest oracle communications cloud native core network repository function Vulnerabilities

● CVE-2022-22963

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

VMware Tanzu Spring Cloud

Vmware Spring Cloud Function<=3.1.6

Vmware Spring Cloud Function>=3.2.0<=3.2.2

Oracle Banking Branch=14.5

Oracle Banking Cash Management=14.5

Oracle Banking Corporate Lending Process Management=14.5

and 42 more

● CVE-2022-22965

Spring Framework JDK 9+ Remote Code Execution Vulnerability

VMware Spring Framework

VMware Spring Framework<5.2.20

VMware Spring Framework>=5.3.0<5.3.18

Cisco CX Cloud Agent<2.1.0

Oracle Communications Cloud Native Core Automated Test Suite=1.9.0

Oracle Communications Cloud Native Core Automated Test Suite=22.1.0

and 84 more

● CVE-2022-22946

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager....

VMware Spring Cloud Gateway=3.1.0

Oracle Commerce Guided Search=11.3.2

Oracle Communications Cloud Native Core Binding Support Function=22.1.3

Oracle Communications Cloud Native Core Console=22.2.0

Oracle Communications Cloud Native Core Network Repository Function=22.1.2

Oracle Communications Cloud Native Core Network Repository Function=22.2.0

and 1 more

● CVE-2022-22947

VMware Spring Cloud Gateway Code Injection Vulnerability

maven/org.springframework.cloud:spring-cloud-gateway>=3.1.0<3.1.1

maven/org.springframework.cloud:spring-cloud-gateway<3.0.7

VMware Spring Cloud Gateway

VMware Spring Cloud Gateway<3.0.7

VMware Spring Cloud Gateway=3.1.0

Oracle Commerce Guided Search=11.3.2

and 13 more

● CVE-2022-23308

A flaw was found in libxml2. A call to the xmlGetID function can return a pointer already freed when parsing an XML document with the XML_PARSE_DTDVALID option and without the XML_PARSE_NOENT option, ...

redhat/jbcs-httpd24-apr-util<0:1.6.1-91.el8

redhat/jbcs-httpd24-curl<0:7.78.0-3.el8

redhat/jbcs-httpd24-httpd<0:2.4.37-80.el8

redhat/jbcs-httpd24-nghttp2<0:1.39.2-41.el8

redhat/jbcs-httpd24-openssl<1:1.1.1g-11.el8

redhat/jbcs-httpd24-openssl-chil<0:1.0.0-11.el8

and 75 more

● CVE-2022-23219

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may ...

GNU glibc<=2.34

Oracle Communications Cloud Native Core Binding Support Function=22.1.3

Oracle Communications Cloud Native Core Network Function Cloud Native Environment=22.1.0

Oracle Communications Cloud Native Core Network Repository Function=22.1.2

Oracle Communications Cloud Native Core Network Repository Function=22.2.0

Oracle Communications Cloud Native Core Security Edge Protection Proxy=22.1.1

and 5 more

● CVE-2021-22569

A flaw was found in protobuf-java. Google Protocol Buffer (protobuf-java) allows the interleaving of com.google.protobuf.UnknownFieldSet fields. By persuading a victim to open specially-crafted conten...

IBM Security Verify Governance<=10.0

redhat/protobuf<3.16.1

redhat/protobuf<3.18.2

redhat/protobuf<3.19.2

Google Google-protobuf Ruby<3.19.2

Google Protobuf-java<3.16.1

and 10 more

● CVE-2021-45105

Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el8

debian/apache-log4j2

debian/apache-log4j2<=2.16.0-1~deb10u1<=2.16.0-1<=2.16.0-1~deb11u1

and 217 more

● CVE-2021-43527

A flaw was found in the way NSS verifies certificates. That will happen both when client reads the Certificate message from the server or when server is configured to ask for client certificates and t...

redhat/nss<0:3.44.0-12.el6_10

redhat/nss<0:3.67.0-4.el7_9

redhat/nss<0:3.28.4-2.el7_3

redhat/nss<0:3.28.4-18.el7_4

redhat/nss<0:3.36.0-10.2.el7_6

redhat/nss<0:3.44.0-8.el7_7

and 22 more

● CVE-2021-43396

** DISPUTED ** In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompani...

GNU glibc=2.34

Oracle Communications Cloud Native Core Binding Support Function=22.1.3

Oracle Communications Cloud Native Core Network Function Cloud Native Environment=22.1.0

Oracle Communications Cloud Native Core Network Repository Function=22.1.2

Oracle Communications Cloud Native Core Network Repository Function=22.2.0

Oracle Communications Cloud Native Core Security Edge Protection Proxy=22.1.1

and 4 more

● CVE-2021-22947

curl. Multiple issues were addressed by updating to curl version 7.79.1.

redhat/rh-dotnet31-curl<0:7.61.1-22.el7_9

redhat/curl<0:7.61.1-18.el8_4.2

redhat/curl<0:7.61.1-12.el8_2.4

debian/curl<=7.64.0-4+deb10u2

Apple macOS Monterey<12.3

redhat/curl<7.79.0

and 62 more

● CVE-2021-22946

curl. Multiple issues were addressed by updating to curl version 7.79.1.

redhat/rh-dotnet31-curl<0:7.61.1-22.el7_9

redhat/curl<0:7.61.1-18.el8_4.2

redhat/curl<0:7.61.1-12.el8_2.4

debian/curl<=7.64.0-4+deb10u2

Apple macOS Monterey<12.3

IBM QRadar SIEM<=7.5.0 GA

and 68 more

● CVE-2021-38604

In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was ...

GNU glibc<=2.34

Fedoraproject Fedora=35

Oracle Communications Cloud Native Core Binding Support Function=22.1.3

Oracle Communications Cloud Native Core Network Function Cloud Native Environment=22.1.0

Oracle Communications Cloud Native Core Network Repository Function=22.1.2

Oracle Communications Cloud Native Core Network Repository Function=22.2.0

and 5 more

● CVE-2021-22897

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The se...

Haxx Curl>=7.61.0<=7.76.1

Oracle Communications Cloud Native Core Binding Support Function=1.11.0

Oracle Communications Cloud Native Core Network Function Cloud Native Environment=1.10.0

Oracle Communications Cloud Native Core Network Repository Function=1.15.0

Oracle Communications Cloud Native Core Network Repository Function=1.15.1

Oracle Communications Cloud Native Core Network Slice Selection Function=1.8.0

and 45 more

● CVE-2021-33560

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appr...

GnuPG Libgcrypt<1.8.8

GnuPG Libgcrypt>=1.9.0<1.9.3

Debian Debian Linux=9.0

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Oracle Communications Cloud Native Core Binding Support Function=1.11.0

and 10 more

● CVE-2021-22898

cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a flaw in the option parser for sending NEW_ENV variables. By sending a specially-crafted request using a clear-te...

redhat/curl<0:7.61.1-22.el8

debian/curl<=7.64.0-4+deb10u2

debian/curl<=7.74.0-1.2<=7.64.0-4<=7.64.0-4+deb10u2<=7.64.0-4+deb10u1

Haxx Curl>=7.7<=7.76.1

Debian Debian Linux=9.0

Fedoraproject Fedora=33

and 19 more

● CVE-2021-22901

A use-after-free flaw was found in the way curl handled TLS session data. The curl versions using the OpenSSL library as their TLS backend could use freed memory after TLS session renegotiation was pe...

redhat/jbcs-httpd24<0:1-18.el8

redhat/jbcs-httpd24-apr<0:1.6.3-105.el8

redhat/jbcs-httpd24-apr-util<0:1.6.1-82.el8

redhat/jbcs-httpd24-brotli<0:1.0.6-40.el8

redhat/jbcs-httpd24-curl<0:7.77.0-2.el8

redhat/jbcs-httpd24-httpd<0:2.4.37-74.el8

and 68 more

● CVE-2021-29425

Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the FileNameUtils.normalize method. An attacker could send a specially-cra...

redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea

redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea

redhat/eap7-jberet<0:1.3.9-1.Final_redhat_00001.1.el6ea

and 185 more

● CVE-2020-8908

A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure.

redhat/eap7-activemq-artemis<0:2.9.0-9.redhat_00019.1.el6ea

redhat/eap7-bouncycastle<0:1.68.0-1.redhat_00001.1.el6ea

redhat/eap7-guava-failureaccess<0:1.0.1-1.redhat_00002.1.el6ea

redhat/eap7-guava-libraries<0:30.1.0-1.redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.13-1.Final_redhat_00001.1.el6ea

redhat/eap7-ironjacamar<0:1.4.27-1.Final_redhat_00001.1.el6ea

and 69 more

● CVE-2020-36518

A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects.

debian/jackson-databind<=2.9.8-3+deb10u3

redhat/jackson-databind<0:2.14.1-2.el9

redhat/eap7-jackson-databind<0:2.12.6.1-1.redhat_00003.1.el8ea

redhat/eap7-jackson-databind<0:2.12.6.1-1.redhat_00003.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el8

and 88 more

● CVE-2020-14340

A flaw was found in xnio. A file descriptor leak caused by growing amounts of NIO Selector file, handled between garbage collection cycles, may allow the attacker to cause a denial of service. The hig...

redhat/eap7-activemq-artemis<0:2.9.0-5.redhat_00011.1.el6ea

redhat/eap7-activemq-artemis-native<1:1.0.2-1.redhat_00001.1.el6ea

redhat/eap7-apache-commons-codec<0:1.14.0-1.redhat_00001.1.el6ea

redhat/eap7-apache-commons-lang<0:3.10.0-1.redhat_00001.1.el6ea

redhat/eap7-apache-cxf<0:3.3.7-1.redhat_00001.1.el6ea

redhat/eap7-artemis-native<1:1.0.2-3.redhat_1.el6ea

and 102 more

● CVE-2019-13734

An out of bounds write flaw was found in the SQLite component of the Chromium browser. Upstream bug(s): <a href="https://code.google.com/p/chromium/issues/detail?id=1025466">https://code.google.com/...

IBM ISAM<=9.0.7

IBM Security Verify Access<=10.0.0

Google Chrome<79.0.3945.79

Fedoraproject Fedora=30

Fedoraproject Fedora=31

Redhat Openshift Container Platform=3.11

and 52 more

● CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 779 more

Latest oracle communications cloud native core network repository function Vulnerabilities

Company

Resources

Contact