Oracle Banking Supply Chain Finance vulnerabilities

26 CVEs affecting Oracle Banking Supply Chain Finance, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22963, published 2022-04-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability, published 2022-04-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-08-25. EPSS: 99.9% chance of exploitation in the next 30 days. In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression…
CVE-2020-26217, published 2020-11-16. High severity, CVSS 8.8. EPSS: 85% chance of exploitation in the next 30 days. XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.…
CVE-2021-29505, published 2021-05-28. High severity, CVSS 8.8. EPSS: 77.2% chance of exploitation in the next 30 days. XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of…
CVE-2021-23337, published 2021-02-15. High severity, CVSS 7.2. EPSS: 21.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2020-36179, published 2021-01-07. High severity, CVSS 8.1. EPSS: 17.1% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
CVE-2020-35728, published 2020-12-27. High severity, CVSS 8.1. EPSS: 12.5% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka…
CVE-2019-0228, published 2019-04-17. Critical severity, CVSS 9.8. EPSS: 9.5% chance of exploitation in the next 30 days. Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
CVE-2020-36188, published 2021-01-06. High severity, CVSS 8.1. EPSS: 8.8% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
CVE-2020-36184, published 2021-01-06. High severity, CVSS 8.1. EPSS: 8.3% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
CVE-2020-24616, published 2020-08-25. High severity, CVSS 8.1. EPSS: 7.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

Latest

CVE-2021-31812, published 2021-06-12. Medium severity, CVSS 5.5. EPSS: 3.1% chance of exploitation in the next 30 days. In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-31811, published 2021-06-12. Medium severity, CVSS 5.5. EPSS: 3.6% chance of exploitation in the next 30 days. In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-27906, published 2021-03-19. Medium severity, CVSS 5.5. EPSS: 3.3% chance of exploitation in the next 30 days. A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
CVE-2020-28500, published 2021-02-15. Medium severity, CVSS 5.3. EPSS: 7.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVE-2020-36183, published 2021-01-07. High severity, CVSS 8.1. EPSS: 5% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.
CVE-2020-36182, published 2021-01-07. High severity, CVSS 8.1. EPSS: 4.1% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.
CVE-2020-36180, published 2021-01-07. High severity, CVSS 8.1. EPSS: 4.1% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.