Oracle Banking Digital Experience vulnerabilities

31 CVEs affecting Oracle Banking Digital Experience, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-41165, published 2021-11-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11022, published 2020-04-29. Medium severity, CVSS 6.1. EPSS: 99.2% chance of exploitation in the next 30 days. In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may…
CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2021-28164, published 2021-04-01. Medium severity, CVSS 5.3. EPSS: 82.4% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF…
CVE-2020-9548, published 2020-03-02. Critical severity, CVSS 9.8. EPSS: 18.9% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVE-2020-11987, published 2021-02-24. High severity, CVSS 8.2. EPSS: 13.3% chance of exploitation in the next 30 days. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this…
CVE-2021-36090, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.9% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35516, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.4% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35515, published 2021-07-13. High severity, CVSS 7.5. EPSS: 11.6% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack…
CVE-2021-35517, published 2021-07-13. High severity, CVSS 7.5. EPSS: 10.6% chance of exploitation in the next 30 days. When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…

Latest

CVE-2021-41165, published 2021-11-17. Medium severity, CVSS 5.4. EPSS: 1.6% chance of exploitation in the next 30 days. CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The…
CVE-2021-41164, published 2021-11-17. Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days. CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4.…
CVE-2021-37137, published 2021-10-19. High severity, CVSS 7.5. EPSS: 6.6% chance of exploitation in the next 30 days. The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was…
CVE-2021-37136, published 2021-10-19. High severity, CVSS 7.5. EPSS: 5.9% chance of exploitation in the next 30 days. The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of…
CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…