Enterprise Communications Broker (Oracle) - vulnerabilities (CVEs)

28 CVEs, 0 in the last 30 days, 13 known versions, newest CVE from 2021-08-24. Vendor: Oracle.

CVEs of Enterprise Communications Broker

CVE-2021-3712 - CVSS 7.4 (high), 2021-08-24: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the…
CVE-2021-3711 - CVSS 9.8 (critical), 2021-08-24: In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this…
CVE-2021-23017 - CVSS 7.7 (high), 2021-06-01: A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory…
CVE-2021-29425 - CVSS 6.5 (medium), 2021-04-13: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result…
CVE-2021-23337 - CVSS 7.2 (high), 2021-02-15: Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2020-28500 - CVSS 5.3 (medium), 2021-02-15: Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVE-2020-1971 - CVSS 5.9 (medium), 2020-12-08: The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a…
CVE-2020-14722 - CVSS 5.8 (medium), 2020-07-15: Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI). Supported versions that are…
CVE-2020-14721 - CVSS 6.3 (medium), 2020-07-15: Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI). Supported versions that are…
CVE-2020-14563 - CVSS 6.1 (medium), 2020-07-15: Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications (component: WebGUI). Supported versions that are…
CVE-2020-8203 - CVSS 7.4 (high), 2020-07-15: Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
CVE-2020-11080 - CVSS 7.5 (high), 2020-06-03: In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious…
CVE-2020-10726 - CVSS 6 (medium), 2020-05-20: A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending…
CVE-2020-10725 - CVSS 7.7 (high), 2020-05-20: A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on…
CVE-2020-10722 - CVSS 6.7 (medium), 2020-05-19: A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller…
CVE-2020-10723 - CVSS 6.7 (medium), 2020-05-19: A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain…
CVE-2019-10219 - CVSS 6.5 (medium), 2019-11-08: A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious…
CVE-2019-9513 - CVSS 7.5 (high), 2019-08-13: Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and…
CVE-2019-9511 - CVSS 7.5 (high), 2019-08-13: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The…
CVE-2018-16865 - CVSS 7.8 (high), 2019-01-11: An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many…
CVE-2018-16864 - CVSS 7.8 (high), 2019-01-11: An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program…
CVE-2018-11236 - CVSS 9.8 (critical), 2018-05-18: stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could…
CVE-2018-11237 - CVSS 7.8 (high), 2018-05-18: An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target…
CVE-2018-6485 - CVSS 9.8 (critical), 2018-02-01: An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause…
CVE-2016-3516 - CVSS 3.1 (low), 2016-07-21: Unspecified vulnerability in the Oracle Enterprise Communications Broker component in Oracle Communications Applications before PCz 2.0.0m4p1 allows remote…
CVE-2016-3515 - CVSS 7.5 (high), 2016-07-21: Unspecified vulnerability in the Oracle Enterprise Communications Broker component in Oracle Communications Applications before PCz 2.0.0m4p1 allows remote…
CVE-2016-3514 - CVSS 6.5 (medium), 2016-07-21: Unspecified vulnerability in the Oracle Enterprise Communications Broker component in Oracle Communications Applications before PCz 2.0.0m4p1 allows remote…
CVE-2014-9708 - CVSS 5 (medium), 2015-03-31: Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an…