Oracle Banking Virtual Account Management vulnerabilities

39 CVEs affecting Oracle Banking Virtual Account Management, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-21908, published 2023-04-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability, published 2022-04-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-08-25. EPSS: 99.9% chance of exploitation in the next 30 days. In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression…
CVE-2020-26217, published 2020-11-16. High severity, CVSS 8.8. EPSS: 85% chance of exploitation in the next 30 days. XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.…
CVE-2021-21351, published 2021-03-23. Critical severity, CVSS 9.1. EPSS: 82.1% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a…
CVE-2021-21346, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 76.4% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code…
CVE-2021-21344, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 76% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code…
CVE-2021-21345, published 2021-03-23. Critical severity, CVSS 9.9. EPSS: 72.3% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute…
CVE-2021-21342, published 2021-03-23. Critical severity, CVSS 9.1. EPSS: 50% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type…
CVE-2021-21349, published 2021-03-23. High severity, CVSS 8.6. EPSS: 46.8% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal…
CVE-2021-21343, published 2021-03-23. High severity, CVSS 7.5. EPSS: 46.7% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type…
CVE-2020-36179, published 2021-01-07. High severity, CVSS 8.1. EPSS: 17.1% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

Latest

CVE-2023-21908, published 2023-04-18. Medium severity, CVSS 6.0. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: OBVAM Trn Journal Domain). Supported versions that are affected are 14.5,…
CVE-2023-21907, published 2023-04-18. Medium severity, CVSS 6.0. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: OBVAM Trn Journal Domain). Supported versions that are affected are 14.5,…
CVE-2023-21906, published 2023-04-18. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: SMS Module). Supported versions that are affected are 14.5, 14.6 and …
CVE-2023-21905, published 2023-04-18. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: Routing Hub). Supported versions that are affected are 14.5, 14.6 and …
CVE-2023-21904, published 2023-04-18. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: OBVAM Trn Journal Domain). Supported versions that are affected are 14.5,…
CVE-2023-21903, published 2023-04-18. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: OBVAM Internal Tfr Domain). Supported versions that are affected are…
CVE-2021-21350, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 15.2% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by…