Communications Offline Mediation Controller (Oracle) - vulnerabilities (CVEs)

37 CVEs, 0 in the last 30 days, 5 known versions, newest CVE from 2022-01-18. Vendor: Oracle.

CVEs of Communications Offline Mediation Controller

CVE-2022-23305 - CVSS 9.8 (critical), 2022-01-18: By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from…
CVE-2022-23302 - CVSS 8.8 (high), 2022-01-18: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if…
CVE-2022-23307 - CVSS 8.8 (high), 2022-01-18: CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x…
CVE-2021-44832 - CVSS 6.6 (medium), 2021-12-28: Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when…
CVE-2021-4104 - CVSS 7.5 (high), 2021-12-14: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can…
CVE-2021-29425 - CVSS 6.5 (medium), 2021-04-13: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result…
CVE-2021-28041 - CVSS 7.1 (high), 2021-03-05: ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy…
CVE-2020-11987 - CVSS 8.2 (high), 2021-02-24: Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted…
CVE-2021-23336 - CVSS 5.9 (medium), 2021-02-15: The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to…
CVE-2021-3177 - CVSS 9.8 (critical), 2021-01-19: Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications…
CVE-2020-36183 - CVSS 8.1 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36182 - CVSS 8.8 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36180 - CVSS 8.8 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36179 - CVSS 8.8 (high), 2021-01-07: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36186 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36189 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36185 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36188 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36184 - CVSS 8.8 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36187 - CVSS 8.1 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-36181 - CVSS 8.8 (high), 2021-01-06: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-35491 - CVSS 8.1 (high), 2020-12-17: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-35490 - CVSS 8.1 (high), 2020-12-17: FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-27783 - CVSS 6.1 (medium), 2020-12-03: A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors…
CVE-2020-25649 - CVSS 7.5 (high), 2020-12-03: A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity…
CVE-2020-27218 - CVSS 4.8 (medium), 2020-11-28: In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is…
CVE-2019-17566 - CVSS 7.5 (high), 2020-11-12: Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted…
CVE-2020-28196 - CVSS 7.5 (high), 2020-11-06: MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the…
CVE-2020-27216 - CVSS 7 (high), 2020-10-23: In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's…
CVE-2020-25648 - CVSS 7.5 (high), 2020-10-20: A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing…
CVE-2020-24750 - CVSS 8.1 (high), 2020-09-17: FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-24616 - CVSS 8.1 (high), 2020-08-25: FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to…
CVE-2020-12723 - CVSS 7.5 (high), 2020-06-05: regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
CVE-2020-10878 - CVSS 8.6 (high), 2020-06-05: Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to…
CVE-2020-10543 - CVSS 8.2 (high), 2020-06-05: Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
CVE-2020-9488 - CVSS 3.7 (low), 2020-04-27: Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a…
CVE-2019-10219 - CVSS 6.5 (medium), 2019-11-08: A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious…