Flexcube Private Banking (Oracle) - vulnerabilities (CVEs)

76 CVEs, 0 in the last 30 days, 20 known versions, newest CVE from 2022-02-01. Vendor: Oracle.

CVEs of Flexcube Private Banking

CVE-2021-43859 - CVSS 7.5 (high), 2022-02-01: XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU…
CVE-2021-44832 - CVSS 6.6 (medium), 2021-12-28: Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when…
CVE-2021-40690 - CVSS 7.5 (high), 2021-09-19: All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not…
CVE-2021-2351 - CVSS 8.3 (high), 2021-07-21: Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c.…
CVE-2021-26117 - CVSS 7.5 (high), 2021-01-27: The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to…
CVE-2020-27218 - CVSS 4.8 (medium), 2020-11-28: In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is…
CVE-2020-27216 - CVSS 7 (high), 2020-10-23: In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's…
CVE-2020-11979 - CVSS 7.5 (high), 2020-10-01: As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access…
CVE-2020-5421 - CVSS 8.7 (high), 2020-09-19: In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD…
CVE-2020-13920 - CVSS 5.9 (medium), 2020-09-10: Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to…
CVE-2020-11998 - CVSS 9.8 (critical), 2020-09-10: A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that…
CVE-2020-5413 - CVSS 9.8 (critical), 2020-07-31: Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options,…
CVE-2020-11973 - CVSS 9.8 (critical), 2020-05-14: Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should…
CVE-2020-11972 - CVSS 9.8 (critical), 2020-05-14: Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should…
CVE-2020-11971 - CVSS 7.5 (high), 2020-05-14: Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.
CVE-2020-1941 - CVSS 6.1 (medium), 2020-05-14: In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
CVE-2020-1945 - CVSS 6.3 (medium), 2020-05-14: Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and…
CVE-2020-9488 - CVSS 3.7 (low), 2020-04-27: Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a…
CVE-2020-9489 - CVSS 5.5 (medium), 2020-04-27: A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or…
CVE-2020-1951 - CVSS 5.5 (medium), 2020-03-23: A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
CVE-2020-1950 - CVSS 5.5 (medium), 2020-03-23: A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.
CVE-2020-5397 - CVSS 5.3 (medium), 2020-01-17: Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module)…
CVE-2020-5398 - CVSS 8 (high), 2020-01-17: In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a…
CVE-2019-17573 - CVSS 6.1 (medium), 2020-01-16: By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected…
CVE-2019-12423 - CVSS 7.5 (high), 2020-01-16: Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the…
CVE-2019-10219 - CVSS 6.5 (medium), 2019-11-08: A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious…
CVE-2019-12419 - CVSS 9.8 (critical), 2019-11-06: Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability…
CVE-2019-12406 - CVSS 6.5 (medium), 2019-11-06: Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a…
CVE-2019-12415 - CVSS 5.5 (medium), 2019-10-23: In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an…
CVE-2019-2904 - CVSS 9.8 (critical), 2019-10-16: Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are…
CVE-2019-17359 - CVSS 7.5 (high), 2019-10-08: The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted…
CVE-2019-12402 - CVSS 7.5 (high), 2019-08-30: The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted…
CVE-2019-10086 - CVSS 7.3 (high), 2019-08-20: In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader…
CVE-2019-13990 - CVSS 9.8 (critical), 2019-07-26: initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
CVE-2019-0188 - CVSS 7.5 (high), 2019-05-28: Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library.…
CVE-2019-0227 - CVSS 7.5 (high), 2019-05-01: A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits…
CVE-2019-5427 - CVSS 7.5 (high), 2019-04-22: c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity…
CVE-2019-10246 - CVSS 5.3 (medium), 2019-04-22: In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory…
CVE-2019-10247 - CVSS 5.3 (medium), 2019-04-22: In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will…
CVE-2019-3773 - CVSS 9.8 (critical), 2019-01-18: Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when…
CVE-2018-15756 - CVSS 7.5 (high), 2018-10-18: Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide…
CVE-2018-11775 - CVSS 7.4 (high), 2018-09-10: TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a…
CVE-2018-8032 - CVSS 6.1 (medium), 2018-08-02: Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVE-2018-11040 - CVSS 7.5 (high), 2018-06-25: Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain…
CVE-2018-1257 - CVSS 6.5 (medium), 2018-05-11: Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over…
CVE-2018-10237 - CVSS 5.9 (medium), 2018-04-26: Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that…
CVE-2017-10103 - CVSS 6.5 (medium), 2017-08-08: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-10007 - CVSS 4.3 (medium), 2017-08-08: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-10010 - CVSS 4.6 (medium), 2017-08-08: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: FileUploads). Supported versions that…
CVE-2017-10022 - CVSS 4.3 (medium), 2017-08-08: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Operations). Supported versions that…
CVE-2017-10006 - CVSS 6.5 (medium), 2017-08-08: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-10009 - CVSS 4.3 (medium), 2017-08-08: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-10012 - CVSS 5.4 (medium), 2017-08-08: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Operations). Supported versions that…
CVE-2017-10005 - CVSS 6.1 (medium), 2017-08-08: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-10008 - CVSS 4.3 (medium), 2017-08-08: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-10011 - CVSS 5.5 (medium), 2017-08-08: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-10023 - CVSS 6.5 (medium), 2017-08-08: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Operations). Supported versions that…
CVE-2017-3479 - CVSS 5.4 (medium), 2017-04-24: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-3478 - CVSS 5.4 (medium), 2017-04-24: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-3477 - CVSS 4.2 (medium), 2017-04-24: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-3476 - CVSS 7.1 (high), 2017-04-24: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-3471 - CVSS 4.7 (medium), 2017-04-24: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-3475 - CVSS 5 (medium), 2017-04-24: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-3473 - CVSS 4.3 (medium), 2017-04-24: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions…
CVE-2017-3472 - CVSS 8.1 (high), 2017-04-24: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Portfolio Management). Supported…
CVE-2016-8312 - CVSS 8.2 (high), 2017-01-27: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search).…
CVE-2016-8308 - CVSS 4.3 (medium), 2017-01-27: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search).…
CVE-2016-8313 - CVSS 4.1 (medium), 2017-01-27: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search).…
CVE-2016-8282 - CVSS 6.1 (medium), 2017-01-27: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search).…
CVE-2016-5623 - CVSS 5.4 (medium), 2017-01-27: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search).…
CVE-2016-8298 - CVSS 8.1 (high), 2017-01-27: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search).…
CVE-2016-5614 - CVSS 4.3 (medium), 2017-01-27: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search).…
CVE-2016-8300 - CVSS 5.3 (medium), 2017-01-27: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search).…
CVE-2016-5493 - CVSS 4.2 (medium), 2016-10-25: Unspecified vulnerability in the Oracle FLEXCUBE Private Banking component in Oracle Financial Services Applications 12.0.1 through 12.0.3 allows remote…
CVE-2016-3081 - CVSS 8.1 (high), 2016-04-26: Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute…
CVE-2013-4316 - CVSS 10 (critical), 2013-09-30: Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.