Oracle Banking Enterprise Default Managment vulnerabilities

4 CVEs affecting Oracle Banking Enterprise Default Managment, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-35043, published 2021-07-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…
CVE-2020-9281, published 2020-03-07. Medium severity, CVSS 6.1. EPSS: 4.3% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with…
CVE-2019-10219, published 2019-11-08. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.…
CVE-2021-35043, published 2021-07-19. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement…