Oracle Banking Payments vulnerabilities

35 CVEs affecting Oracle Banking Payments, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-21915, published 2023-04-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2019-13990, published 2019-07-26. Critical severity, CVSS 9.8. EPSS: 16.6% chance of exploitation in the next 30 days. initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
CVE-2019-12402, published 2019-08-30. High severity, CVSS 7.5. EPSS: 16.2% chance of exploitation in the next 30 days. The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service…
CVE-2021-36090, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.9% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35515, published 2021-07-13. High severity, CVSS 7.5. EPSS: 11.6% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack…
CVE-2021-35517, published 2021-07-13. High severity, CVSS 7.5. EPSS: 10.6% chance of exploitation in the next 30 days. When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2018-10237, published 2018-04-26. Medium severity, CVSS 5.9. EPSS: 5.1% chance of exploitation in the next 30 days. Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize…
CVE-2021-41973, published 2021-11-01. Medium severity, CVSS 6.5. EPSS: 4.6% chance of exploitation in the next 30 days. In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer…
CVE-2019-12399, published 2020-01-14. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to…
CVE-2021-30129, published 2021-07-12. Medium severity, CVSS 6.5. EPSS: 3% chance of exploitation in the next 30 days. A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD…

Latest

CVE-2023-21915, published 2023-04-18. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Book/Internal Transfer). Supported versions that are affected are 14.5, 14.6 and 14.7.…
CVE-2022-21475, published 2022-04-19. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit…
CVE-2020-14896, published 2020-10-21. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Core). Supported versions that are affected are 14.1.0-14.4.0. Easily exploitable…
CVE-2020-2714, published 2020-01-15. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Core). Supported versions that are affected are 14.1.0-14.3.0. Easily exploitable…