Oracle Banking Liquidity Management vulnerabilities

9 CVEs affecting Oracle Banking Liquidity Management, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-21285, published 2024-10-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability, published 2022-04-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-08-25. EPSS: 99.9% chance of exploitation in the next 30 days. In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression…
CVE-2020-24616, published 2020-08-25. High severity, CVSS 8.1. EPSS: 7.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
CVE-2020-24750, published 2020-09-17. High severity, CVSS 8.1. EPSS: 7.3% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
CVE-2020-8203, published 2020-07-15. High severity, CVSS 7.4. EPSS: 5.2% chance of exploitation in the next 30 days. Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
CVE-2019-12399, published 2020-01-14. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to…
CVE-2020-1945, published 2020-05-14. Medium severity, CVSS 6.3. EPSS: 1.8% chance of exploitation in the next 30 days. Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The…
CVE-2024-21285, published 2024-10-15. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). The supported version that is affected is 14.5.0.12.0. Difficult to…
CVE-2024-21284, published 2024-10-15. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). The supported version that is affected is 14.5.0.12.0. Difficult to…
CVE-2024-21281, published 2024-10-15. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.7.0.6.0.…