Oracle Communications Cloud Native Core Console vulnerabilities

• vmware spring cloud function, vmware tanzu spring cloud, oracle banking branch +26 more +28 more Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression CVE-2022-22963 In KEVPublic exploitFix available EPSS 99.9% 9.8 CriticalApril 1, 2022
• vmware spring framework, cisco cx cloud agent, oracle commerce platform +35 more +37 more Remote Code Execution in Spring Framework CVE-2022-22965 In KEVPublic exploitFix available EPSS 99.6% 9.8 CriticalMarch 31, 2022
• fasterxml jackson-databind, debian linux, netapp active iq unified manager +33 more +35 more Deeply nested json in jackson-databind CVE-2020-36518 Public exploitFix available 7.5 HighMarch 11, 2022
• vmware spring cloud gateway, oracle commerce guided search, communications cloud native core binding support function +3 more +5 more In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable... CVE-2022-22946 5.5 MediumMarch 4, 2022
• vmware spring cloud gateway, oracle commerce guided search, communications cloud native core binding support function +7 more +9 more Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured CVE-2022-22947 In KEVPublic exploitFix available EPSS 98.3% 10.0 CriticalMarch 3, 2022
• cyrusimap cyrus-sasl, debian linux, fedoraproject fedora +8 more +10 more In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for... CVE-2022-24407 Fix available 8.8 HighFebruary 22, 2022
• h2database h2, debian linux, oracle communications cloud native core console +2 more Arbitrary code execution in H2 Console CVE-2022-23221 Public exploitFix available EPSS 64.8% 9.8 CriticalJanuary 19, 2022
• vmware spring framework, oracle communications cloud native core console, communications cloud native core service communication proxy +2 more Log entry injection in Spring Framework CVE-2021-22060 Fix available 4.3 MediumJanuary 7, 2022
• google protobuf-java, google-protobuf, google-protobuf [jruby gem] +5 more +7 more Denial of Service of protobuf-java parsing procedure CVE-2021-22569 Public exploitFix available 7.5 HighJanuary 7, 2022
• apache log4j, apache software foundation log4j2, debian linux +114 more +116 more Apache Log4j2 does not always protect from infinite recursion in lookup evaluation CVE-2021-45105 Public exploitFix available EPSS 100.0% 5.9 MediumDecember 18, 2021
• apache mina, oracle banking payments, banking trade finance process management +6 more +8 more Apache MINA HTTP listener DOS CVE-2021-41973 Fix available 6.5 MediumNovember 1, 2021
• vmware spring framework, netapp active iq unified manager, management services for element software and netapp hci +5 more +7 more Improper Output Neutralization for Logs in Spring Framework CVE-2021-22096 Fix available 4.3 MediumOctober 28, 2021
• oracle mysql connectors, communications cloud native core console, communications cloud native core network slice selection function +3 more +5 more Incorrect Authorization in MySQL Connector Java CVE-2021-2471 Public exploitFix available 5.9 MediumOctober 20, 2021
• haxx curl, apple macos, debian linux +26 more +28 more When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using... CVE-2021-22947 Fix available 5.9 MediumSeptember 15, 2021
• haxx curl, apple macos, debian linux +29 more +31 more A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking... CVE-2021-22946 Fix available 7.5 HighSeptember 15, 2021
• openssl, debian linux, mcafee epolicy orchestrator +238 more +240 more Read buffer overruns processing ASN.1 strings CVE-2021-3712 Public exploitFix available EPSS 48.1% 7.4 HighAugust 24, 2021
• apache sshd, apache software foundation mina sshd, oracle banking payments +7 more +9 more DoS/OOM leak vulnerability in Apache Mina SSHD Server CVE-2021-30129 Fix available 6.5 MediumJuly 12, 2021
• redhat xnio, oracle communications cloud native core console, communications cloud native core network repository function +11 more +13 more Uncontrolled Resource Consumption in XNIO CVE-2020-14340 Fix available 5.9 MediumJune 2, 2021
• netty, debian linux, netapp oncommand api services +15 more +17 more Possible request smuggling in HTTP/2 due missing validation of content-length CVE-2021-21409 Fix available 5.9 MediumMarch 30, 2021
• red hat resteasy, netapp oncommand insight, oracle communications cloud native core console +1 more +3 more Exposure of class information in RESTEasy CVE-2021-20289 Fix available 5.3 MediumMarch 26, 2021
• hibernate orm, debian linux, oracle communications cloud native core console +2 more +4 more SQL injection in hibernate-core CVE-2020-25638 Fix available 7.4 HighDecember 2, 2020
• hibernate hibernate-validator, netapp active iq unified manager, element +185 more +187 more The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks CVE-2019-10219 Public exploitFix available 6.5 MediumNovember 8, 2019
• apache commons beanutils, nifi, debian linux +57 more +59 more Insecure Deserialization in Apache Commons Beanutils CVE-2019-10086 Fix available EPSS 29.1% 7.3 HighAugust 20, 2019