Latest oracle flexcube private banking Vulnerabilities

● CVE-2021-43859

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU ...

redhat/jenkins<0:2.319.3.1650348949-1.el7

redhat/xstream<1.4.19

Xstream Project Xstream<1.4.19

Fedoraproject Fedora=34

Fedoraproject Fedora=35

Debian Debian Linux=9.0

and 13 more

● CVE-2021-44832

Apache Log4j could allow a remote attacker with permission to modify the logging configuration file to execute arbitrary code on the system. By constructing a malicious configuration using a JDBC Appe...

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

Apache Log4j=2.0-beta9

Apache Log4j=2.15.0

Apache Log4j=2.17.0

Apache Log4j=1.2.x

and 58 more

● CVE-2021-40690

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from ...

maven/org.apache.santuario:xmlsec<2.1.7

maven/org.apache.santuario:xmlsec>=2.2.0<2.2.3

Apache Santuario XML Security for Java<2.1.7

Apache Santuario XML Security for Java>=2.2.0<2.2.3

Apache CXF=3.4.4

Apache TomEE<8.0.8

and 70 more

● CVE-2021-2351

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unau...

Oracle Advanced Networking Option=12.1.0.2

Oracle Advanced Networking Option=12.2.0.1

Oracle Advanced Networking Option=19c

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

Oracle Agile Product Lifecycle Management for Process=6.2.2.0

and 242 more

● CVE-2020-27218

### Impact If GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection and if an attacker can send a request with a body that is received en...

redhat/jenkins<0:2.289.1.1624365627-1.el7

redhat/jenkins<0:2.277.3.1623846768-1.el7

redhat/jenkins<0:2.277.3.1623853726-1.el8

redhat/jetty<9.4.35.

redhat/jetty<10.0.0.

redhat/jetty<11.0.0.

and 31 more

● CVE-2020-27216

### Impact On Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the sh...

redhat/rh-eclipse<1:4.17-6.el7_9

redhat/rh-eclipse-ant<0:1.10.9-1.2.el7

redhat/rh-eclipse-antlr32<0:3.2-28.1.el7

redhat/rh-eclipse-apache-sshd<1:2.4.0-5.1.el7

redhat/rh-eclipse-apiguardian<0:1.1.0-6.1.el7

redhat/rh-eclipse-args4j<0:2.33-12.2.el7

and 108 more

● CVE-2020-11979

As mitigation for <a href="https://access.redhat.com/security/cve/CVE-2020-1945">CVE-2020-1945</a> Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user...

redhat/jenkins<0:2.263.3.1612433584-1.el7

redhat/conmon<2:2.0.21-1.rhaos4.5.el7

redhat/jenkins<0:2.263.3.1612434332-1.el7

redhat/machine-config-daemon<0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

redhat/openshift<0:4.5.0-202102050524.p0.git.0.9229406.el7

redhat/openshift-ansible<0:4.5.0-202102031005.p0.git.0.c6839a2.el7

and 147 more

● CVE-2020-5421

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depen...

maven/org.springframework:spring-framework-bom<4.3.29

maven/org.springframework:spring-framework-bom>=5.0.0<=5.0.18

maven/org.springframework:spring-framework-bom>=5.1.0<=5.1.17

maven/org.springframework:spring-framework-bom>=5.2.0<=5.2.8

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

redhat/springframework<5.2.9

and 80 more

● CVE-2020-11998

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it le...

Apache ActiveMQ=5.15.12

Oracle Communications Diameter Signaling Router>=8.0.0<=8.5.0

Oracle Communications Element Manager>=8.2.0<=8.2.4.0

Oracle Communications Session Report Manager>=8.0.0<=8.2.2

Oracle Communications Session Route Manager>=8.0.0<=8.2.2

Oracle Enterprise Repository=11.1.1.7.0

and 3 more

● CVE-2020-13920

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and cal...

redhat/Apache ActiveMQ<5.15.12

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

Apache ActiveMQ<5.15.12

Oracle Communications Diameter Signaling Router>=8.0.0<=8.2.2

Oracle FLEXCUBE Private Banking=12.0.0

Oracle FLEXCUBE Private Banking=12.1.0

and 2 more

● CVE-2021-26117

ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

Apache ActiveMQ>=5.15.0<5.15.14

Apache ActiveMQ>=5.16.0<5.16.1

Apache ActiveMQ Artemis<2.16.0

NetApp OnCommand Workflow Automation

Debian Debian Linux=9.0

Oracle Communications Element Manager>=8.2.0<=8.2.4.0

and 7 more

● CVE-2020-5413

Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on de...

Vmware Spring Integration>=4.3.0<=4.3.22

Vmware Spring Integration>=5.1.0<=5.1.11

Vmware Spring Integration>=5.2.0<=5.2.7

Vmware Spring Integration>=5.3.0<=5.3.1

Oracle Banking Corporate Lending Process Management=14.2.0

Oracle Banking Corporate Lending Process Management=14.3.0

and 14 more

● CVE-2020-1941

Apache ActiveMQ is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the admin GUI. A remote attacker could exploit this vulnerability using a specially-craft...

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

Apache ActiveMQ>=5.0.0<=5.15.11

Oracle Communications Diameter Signaling Router>=8.0.0<=8.2.2

Oracle Communications Element Manager=8.1.1

Oracle Communications Element Manager=8.2.0

Oracle Communications Element Manager=8.2.1

and 10 more

● CVE-2020-11973

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to...

redhat/camel<3.2.0

redhat/camel<2.25.1

Apache Camel>=2.22.0<=2.25.0

Apache Camel>=3.0.0<=3.1.0

Oracle Communications Diameter Signaling Router>=8.0.0<=8.5.0

Oracle Enterprise Manager Base Platform=13.3.0.0

and 3 more

● CVE-2020-11971

Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.

Apache Camel>=2.22.0<=3.1.0

Oracle Communications Diameter Intelligence Hub>=8.0.0<=8.1.0

Oracle Communications Diameter Intelligence Hub>=8.2.0<=8.2.3

Oracle Communications Diameter Signaling Router>=8.0.0<=8.2.2

Oracle Enterprise Manager Base Platform=13.3.0.0

Oracle Enterprise Manager Base Platform=13.4.0.0

and 2 more

● CVE-2020-11972

Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade...

Apache Camel>=2.22.0<=2.25.0

Apache Camel>=3.0.0<=3.1.0

Oracle Communications Diameter Signaling Router>=8.0.0<=8.2.2

Oracle Enterprise Manager Base Platform=13.3.0.0

Oracle Enterprise Manager Base Platform=13.4.0.0

Oracle FLEXCUBE Private Banking=12.0.0

and 1 more

● CVE-2020-1945

Apache Ant could allow a remote attacker to bypass security restrictions, caused by the use of an insecure temporary directory to store source files. By sending a specially-crafted request, an attacke...

redhat/jenkins<0:2.263.3.1612433584-1.el7

redhat/conmon<2:2.0.21-1.rhaos4.5.el8

redhat/jenkins<0:2.263.3.1612434332-1.el7

redhat/machine-config-daemon<0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

redhat/openshift<0:4.5.0-202102050524.p0.git.0.9229406.el7

redhat/openshift-ansible<0:4.5.0-202102031005.p0.git.0.c6839a2.el7

and 128 more

● CVE-2020-9488

Apache Log4j is vulnerable to a man-in-the-middle attack, caused by improper certificate validation with host mismatch in the SMTP appender. An attacker could exploit this vulnerability to launch a ma...

debian/apache-log4j2

redhat/qpid-cpp<0:1.36.0-31.el6_10a

redhat/qpid-proton<0:0.32.0-1.el6_10

redhat/qpid-cpp<0:1.36.0-31.el7a

redhat/qpid-proton<0:0.32.0-2.el7

redhat/nodejs-rhea<0:1.0.24-1.el8

and 110 more

● CVE-2020-9489

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Pa...

Apache Tika=1.24

Oracle FLEXCUBE Private Banking=12.0.0

Oracle FLEXCUBE Private Banking=12.1.0

Oracle Primavera Unifier>=17.7<=17.12

Oracle Primavera Unifier=16.1

Oracle Primavera Unifier=16.2

and 5 more

● CVE-2020-1951

A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.

ubuntu/tika<1.5-4ubuntu0.1

>=1.0<=1.23

=12.2.1.3.0

=12.2.1.4.0

=8.0.2

=8.1

and 14 more

● CVE-2020-1950

A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.

>=1.0<=1.23

=12.2.1.3.0

=12.2.1.4.0

=8.0.2

=8.1

=12.0.0

and 15 more

● CVE-2020-5397

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) e...

maven/org.springframework:spring-webflux>=5.2.0<5.2.3

maven/org.springframework:spring-webmvc>=5.2.0<5.2.3

VMware Spring Framework>=5.2.0<5.2.3

Oracle Application Testing Suite=13.3.0.1

Oracle Communications Brm - Elastic Charging Engine=11.3

Oracle Communications Brm - Elastic Charging Engine=12.0

and 48 more

● CVE-2019-17573

Apache CXF is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the services listing page. A remote attacker could exploit this vulnerability using a speciall...

redhat/eap7-activemq-artemis<0:2.9.0-4.redhat_00010.1.el6ea

redhat/eap7-apache-cxf<0:3.2.12-1.redhat_00001.1.el6ea

redhat/eap7-bouncycastle<0:1.60.0-2.redhat_00002.1.el6ea

redhat/eap7-codehaus-jackson<0:1.9.13-10.redhat_00007.1.el6ea

redhat/eap7-cryptacular<0:1.2.4-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-el<0:3.0.1-5.b08_redhat_00004.1.el6ea

and 276 more

● CVE-2020-5398

A flaw was found in springframework in versions prior to 5.0.16, 5.1.13, and 5.2.3. A reflected file download (RFD) attack is possible when a "Content-Disposition" header is set in response to where t...

IBM Data Risk Manager<=2.0.6

redhat/springframework<5.2.3

redhat/springframework<5.1.13

redhat/springframework<5.0.16

maven/org.springframework:spring-webflux>=5.0.0.RELEASE<5.0.16.RELEASE

maven/org.springframework:spring-webflux>=5.1.0.RELEASE<5.1.13.RELEASE

and 67 more

● CVE-2019-12423

Apache CXF could allow a remote attacker to obtain sensitive information, caused by a flaw when ships with OpenId Connect JWK Keys service. By accessing the JWK keystore file, an attacker could exploi...

redhat/eap7-activemq-artemis<0:2.9.0-4.redhat_00010.1.el6ea

redhat/eap7-apache-cxf<0:3.2.12-1.redhat_00001.1.el6ea

redhat/eap7-bouncycastle<0:1.60.0-2.redhat_00002.1.el6ea

redhat/eap7-codehaus-jackson<0:1.9.13-10.redhat_00007.1.el6ea

redhat/eap7-cryptacular<0:1.2.4-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-el<0:3.0.1-5.b08_redhat_00004.1.el6ea

and 282 more

● CVE-2019-12419

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it doe...

redhat/cxf<3.3.4

redhat/cxf<3.2.11

Apache CXF>=3.2.0<3.2.11

Apache CXF>=3.3.0<3.3.4

Oracle Commerce Guided Search=11.3.2

Oracle Enterprise Manager Base Platform=13.2.1.0

and 3 more

● CVE-2019-12406

Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a maliciou...

Apache CXF<3.2.11

Apache CXF>=3.3.0<3.3.4

Oracle Commerce Guided Search=11.3.2

Oracle FLEXCUBE Private Banking=12.0.0

Oracle FLEXCUBE Private Banking=12.1.0

Oracle Retail Order Broker=15.0

and 9 more

● CVE-2019-12415

Apache POI could allow a remote attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data by tool XSSFExportToXml. By sending a specially-crafted ...

redhat/poi<4.1.0

IBM Cloud Pak for Business Automation<=V22.0.2

IBM Cloud Pak for Business Automation<=V21.0.3 - V21.0.3-IF016

IBM Cloud Pak for Business Automation<=V22.0.1 - V22.0.1-IF006 and later fixes V21.0.2 - V21.0.2-IF012 and later fixesV21.0.1 - V21.0.1-IF007 and later fixesV20.0.1 - V20.0.3 and later fixesV19.0.1 - V19.0.3 and later fixesV18.0.0 - V18.0.2 and later fixes

Apache POI<=4.1.0

Oracle Application Testing Suite=12.5.0.3

and 63 more

● CVE-2019-2904

Oracle ADF Faces Deserialization of Untrusted Data Remote Code Execution Vulnerability

Oracle ADF Faces

Oracle Application Testing Suite=12.5.0.3

Oracle Application Testing Suite=13.1.0.1

Oracle Application Testing Suite=13.2.0.1

Oracle Application Testing Suite=13.3.0.1

Oracle Banking Enterprise Collections=2.7.0

and 43 more

● CVE-2019-17359

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api=1.63

Apache TomEE=7.0.7

Apache TomEE=7.1.2

Apache TomEE=8.0.1

Netapp Active Iq Unified Manager Linux>=7.3

Netapp Active Iq Unified Manager Windows>=7.3

and 28 more

● CVE-2019-12402

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service at...

maven/io.github.1tchy.java9modular.org.apache.commons:commons-compress=1.18.1

maven/org.apache.commons:commons-compress>=1.15<1.19

redhat/apache-commons-compress<1.19

Apache Commons Compress>=1.15<=1.18

Fedoraproject Fedora=30

Fedoraproject Fedora=31

and 35 more

● CVE-2019-10086

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Jav...

redhat/apache-commons-beanutils<0:1.8.3-15.el7_7

redhat/eap7-activemq-artemis<0:2.9.0-2.redhat_00009.1.el6ea

redhat/eap7-apache-commons-beanutils<0:1.9.4-1.redhat_00002.1.el6ea

redhat/eap7-glassfish-el<0:3.0.1-4.b08_redhat_00003.1.el6ea

redhat/eap7-glassfish-jaxb<0:2.3.3-4.b02_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-7.SP3_redhat_00005.1.el6ea

and 486 more

● CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 779 more

● CVE-2019-13990

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

redhat/rhvm-dependencies<0:4.4.0-1.el8e

IBM Data Risk Manager<=2.0.6

maven/org.quartz-scheduler:quartz<2.3.2

redhat/quartz<2.3.2

Softwareag Quartz<2.3.2

Oracle Apache Batik Mapviewer=12.2.0.1

and 178 more

● CVE-2019-0188

Apache Camel<2.24.0

Oracle Enterprise Data Quality=11.1.1.9.0

Oracle Enterprise Manager Base Platform=13.3.0.0

Oracle Enterprise Manager Base Platform=13.4.0.0

Oracle FLEXCUBE Private Banking=12.0.0

Oracle FLEXCUBE Private Banking=12.1.0

and 1 more

● CVE-2019-0227

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversi...

Apache Axis=1.4

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile Product Lifecycle Management Framework=9.3.3

Oracle Application Testing Suite=13.2.0.1

Oracle Application Testing Suite=13.3.0.1

Oracle Big Data Discovery=1.6

and 76 more

● CVE-2019-10246

Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by a flaw when configured for showing a listing of directory contents. By sending a specially-crafted request, a rem...

Eclipse Jetty=9.2.27-20190403

Eclipse Jetty=9.3.26-20190403

Eclipse Jetty=9.4.16-20190411

Microsoft Windows

NetApp OnCommand System Manager>=3.0<=3.1.3

NetApp Snap Creator Framework

and 49 more

● CVE-2019-10247

Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by a flaw in the DefaultHandler. By sending a specially-crafted request, a remote attacker could exploit this vulner...

IBM Cognos Command Center<=10.2.4.1

debian/jetty9

redhat/jetty<9.2.28

redhat/jetty<9.3.27

redhat/jetty<9.4.16

Eclipse Jetty=7.0.0-20091005

and 334 more

● CVE-2019-5427

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

Mchange C3p0<0.9.5.2

Fedoraproject Fedora=29

Fedoraproject Fedora=30

Oracle Communications Ip Service Activator=7.3.0

Oracle Communications Ip Service Activator=7.4.0

Oracle Communications Session Route Manager>=8.2.0<=8.2.2

and 13 more

● CVE-2019-3773

Spring Web Services XML External Entity Injection (XXE)

<=2.4.3

>=3.0.0<=3.0.4

>=8.0.6<=8.1.0

=12.0.0

=12.1.0

Oracle Financial Services Analytical Applications Infrastructure>=8.0.6<=8.1.0

and 2 more

● CVE-2018-15756

Pivotal Spring Framework is vulnerable to a denial of service, caused by improper handling of range request by the ResourceHttpRequestHandler. By adding a range header with a high number of ranges, a ...

IBM GDE<=3.0.0.2

redhat/springframework<5.0.10

redhat/springframework<4.3.20

VMware Spring Framework>=4.2.0<4.3.20

VMware Spring Framework>=5.0.0<5.0.10

VMware Spring Framework=5.1.0

and 111 more

● CVE-2018-11775

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client a...

maven/org.apache.activemq:activemq-client<5.15.6

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

Apache ActiveMQ<5.15.6

Oracle Enterprise Repository=12.1.3.0.0

Oracle FLEXCUBE Private Banking=2.0.0.0

Oracle FLEXCUBE Private Banking=2.2.0.1

and 3 more

● CVE-2018-8032

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.

Apache Axis>=1.0<=1.4

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile Product Lifecycle Management Framework=9.3.3

Oracle Application Testing Suite=13.2.0.1

Oracle Application Testing Suite=13.3.0.1

Oracle Big Data Discovery=1.6

and 73 more

● CVE-2018-11040

Pivotal Spring Framework could allow a remote attacker to bypass security restrictions, caused by a flaw in AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView. By sending...

IBM GDE<=3.0.0.2

maven/org.springframework:spring-core>=4.3.0<4.3.18

maven/org.springframework:spring-core>=5.0.0<5.0.7

VMware Spring Framework<4.3.18

VMware Spring Framework>=5.0.0<5.0.7

Oracle Agile Product Lifecycle Management=9.3.3

and 48 more

Latest oracle flexcube private banking Vulnerabilities

Company

Resources

Contact