Communications Messaging Server (Oracle) - vulnerabilities (CVEs)

23 CVEs, 0 in the last 30 days, 12 known versions, newest CVE from 2022-01-18. Vendor: Oracle.

CVEs of Communications Messaging Server

CVE-2022-23305 - CVSS 9.8 (critical), 2022-01-18: By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from…
CVE-2022-23302 - CVSS 8.8 (high), 2022-01-18: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if…
CVE-2022-23307 - CVSS 8.8 (high), 2022-01-18: CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x…
CVE-2021-45105 - CVSS 5.9 (medium), 2021-12-18: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This…
CVE-2021-4104 - CVSS 7.5 (high), 2021-12-14: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can…
CVE-2021-40690 - CVSS 7.5 (high), 2021-09-19: All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not…
CVE-2021-37714 - CVSS 7.5 (high), 2021-08-18: jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If…
CVE-2021-35516 - CVSS 7.5 (high), 2021-07-13: When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for…
CVE-2021-35515 - CVSS 7.5 (high), 2021-07-13: When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be…
CVE-2021-36090 - CVSS 7.5 (high), 2021-07-13: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for…
CVE-2021-35517 - CVSS 7.5 (high), 2021-07-13: When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for…
CVE-2021-30468 - CVSS 7.5 (high), 2021-06-16: A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread…
CVE-2021-33813 - CVSS 7.5 (high), 2021-06-16: An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.
CVE-2021-31812 - CVSS 5.5 (medium), 2021-06-12: In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior…
CVE-2021-31811 - CVSS 5.5 (medium), 2021-06-12: In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23…
CVE-2021-28657 - CVSS 5.5 (medium), 2021-03-31: A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26…
CVE-2021-21409 - CVSS 5.9 (medium), 2021-03-30: Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers &…
CVE-2021-27906 - CVSS 5.5 (medium), 2021-03-19: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x…
CVE-2021-27807 - CVSS 5.5 (medium), 2021-03-19: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
CVE-2021-21290 - CVSS 6.2 (medium), 2021-02-08: Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers &…
CVE-2020-36189 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-28052 - CVSS 8.1 (high), 2020-12-18: An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when…
CVE-2020-25649 - CVSS 7.5 (high), 2020-12-03: A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity…
CVE-2020-13954 - CVSS 6.1 (medium), 2020-11-12: By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected…
CVE-2020-24750 - CVSS 8.1 (high), 2020-09-17: FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-24616 - CVSS 8.1 (high), 2020-08-25: FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-15358 - CVSS 5.5 (medium), 2020-06-27: In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive…
CVE-2020-13871 - CVSS 7.5 (high), 2020-06-06: SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-9489 - CVSS 5.5 (medium), 2020-04-27: A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or…
CVE-2020-11656 - CVSS 9.8 (critical), 2020-04-09: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT…
CVE-2020-11655 - CVSS 7.5 (high), 2020-04-09: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's…
CVE-2020-11612 - CVSS 7.5 (high), 2020-04-07: The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large…
CVE-2020-1950 - CVSS 5.5 (medium), 2020-03-23: A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.
CVE-2020-1951 - CVSS 5.5 (medium), 2020-03-23: A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
CVE-2020-9327 - CVSS 7.5 (high), 2020-02-21: In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column…
CVE-2019-10219 - CVSS 6.5 (medium), 2019-11-08: A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious…
CVE-2019-0228 - CVSS 9.8 (critical), 2019-04-17: Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a…
CVE-2017-5645 - CVSS 9.8 (critical), 2017-04-17: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially…
CVE-2016-5455 - CVSS 5.3 (medium), 2016-07-21: Unspecified vulnerability in the Oracle Communications Messaging Server component in Oracle Communications Applications 6.3, 7.0, and 8.0 allows remote…
CVE-2014-7926 - CVSS 7.5 (high), 2015-01-22: The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91,…
CVE-2014-7923 - CVSS 7.5 (high), 2015-01-22: The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91,…