Oracle Communications Brm vulnerabilities

• x-stream xstream, debian linux, fedoraproject fedora +8 more +10 more Denial of Service by injecting highly recursive collections or maps in XStream CVE-2021-43859 Fix available 7.5 HighFebruary 1, 2022
• apache log4j, apache software foundation log4j2, cisco cloudcenter +20 more +22 more Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration CVE-2021-44832 Public exploitFix available EPSS 97.9% 6.6 MediumDecember 28, 2021
• apache kafka, oracle communications brm - elastic charging engine, communications cloud native core policy +5 more +7 more Timing Attack Vulnerability for Apache Kafka Connect and Clients CVE-2021-38153 Fix available 5.9 MediumSeptember 22, 2021
• debian linux, netapp oncommand insight, netty +9 more +11 more SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way CVE-2021-37137 Fix available 7.5 HighSeptember 9, 2021
• debian linux, netapp oncommand insight, netty +16 more +18 more Bzip2Decoder doesn't allow setting size restrictions for decompressed data CVE-2021-37136 Fix available 7.5 HighSeptember 9, 2021
• vmware spring framework, netapp hci, management services for element software +29 more +31 more Improper Privilege Management in Spring Framework CVE-2021-22118 Fix available 7.8 HighMay 27, 2021
• x-stream xstream, debian linux, fedoraproject fedora +14 more +16 more XStream is vulnerable to a Remote Command Execution attack CVE-2021-29505 Public exploitFix available EPSS 77.2% 7.5 HighMay 18, 2021
• netty, debian linux, netapp oncommand api services +15 more +17 more Possible request smuggling in HTTP/2 due missing validation of content-length CVE-2021-21409 Fix available 5.9 MediumMarch 30, 2021
• x-stream xstream, apache activemq, jmeter +12 more +14 more A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host CVE-2021-21342 Fix available EPSS 50.0% 5.3 MediumMarch 22, 2021
• netty, debian linux, netapp active iq unified manager +10 more +12 more Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files CVE-2021-21290 Fix available 6.2 MediumFebruary 8, 2021
• apache groovy, atlas, netapp snapcenter +18 more +20 more Information Disclosure in Apache Groovy CVE-2020-17521 Fix available 5.5 MediumDecember 7, 2020
• spring by vmware framework, vmware spring framework, netapp oncommand insight +36 more +38 more RFD Protection Bypass via jsessionid CVE-2020-5421 Public exploitFix available EPSS 11.6% 8.7 HighSeptember 19, 2020
• netty, debian linux, fedoraproject fedora +10 more +12 more Denial of Service in Netty CVE-2020-11612 Fix available 7.5 HighApril 7, 2020
• spring framework, vmware spring framework, oracle application testing suite +25 more +27 more CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux CVE-2020-5397 Fix available 5.3 MediumJanuary 17, 2020
• pivotal spring framework, debian linux, oracle agile product lifecycle management +37 more +39 more DoS Attack via Range Requests CVE-2018-15756 Fix available 7.5 HighOctober 18, 2018