Oracle Banking Enterprise Default Management vulnerabilities

23 CVEs affecting Oracle Banking Enterprise Default Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-45105, published 2021-12-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2021-21351, published 2021-03-23. Critical severity, CVSS 9.1. EPSS: 82.1% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a…
CVE-2021-21341, published 2021-03-23. High severity, CVSS 7.5. EPSS: 77.8% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the…
CVE-2021-21346, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 76.4% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code…
CVE-2021-21344, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 76% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code…
CVE-2021-21345, published 2021-03-23. Critical severity, CVSS 9.9. EPSS: 72.3% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute…
CVE-2021-21342, published 2021-03-23. Critical severity, CVSS 9.1. EPSS: 50% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type…
CVE-2021-21349, published 2021-03-23. High severity, CVSS 8.6. EPSS: 46.8% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal…
CVE-2021-21343, published 2021-03-23. High severity, CVSS 7.5. EPSS: 46.7% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type…
CVE-2020-13936, published 2021-03-10. High severity, CVSS 8.8. EPSS: 22.7% chance of exploitation in the next 30 days. An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This…

Latest

CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2021-35043, published 2021-07-19. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement…
CVE-2021-36090, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.9% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35517, published 2021-07-13. High severity, CVSS 7.5. EPSS: 10.6% chance of exploitation in the next 30 days. When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35516, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.4% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35515, published 2021-07-13. High severity, CVSS 7.5. EPSS: 11.6% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack…
CVE-2020-6950, published 2021-06-02. Medium severity, CVSS 6.5. EPSS: 10.1% chance of exploitation in the next 30 days. Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…