Oracle Business Activity Monitoring vulnerabilities

29 CVEs affecting Oracle Business Activity Monitoring, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-39152, published 2021-08-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-39144: XStream Remote Code Execution Vulnerability, published 2021-08-23. High severity, CVSS 8.5. Actively exploited: in CISA KEV since 2023-03-10. EPSS: 98.1% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only…
CVE-2019-10173, published 2019-07-23. Critical severity, CVSS 9.8. EPSS: 95% chance of exploitation in the next 30 days. It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote…
CVE-2020-26217, published 2020-11-16. High severity, CVSS 8.8. EPSS: 85% chance of exploitation in the next 30 days. XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.…
CVE-2021-21351, published 2021-03-23. Critical severity, CVSS 9.1. EPSS: 82.1% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a…
CVE-2021-21341, published 2021-03-23. High severity, CVSS 7.5. EPSS: 77.8% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the…
CVE-2021-29505, published 2021-05-28. High severity, CVSS 8.8. EPSS: 77.2% chance of exploitation in the next 30 days. XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of…
CVE-2021-21346, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 76.4% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code…
CVE-2021-21344, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 76% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code…
CVE-2021-21345, published 2021-03-23. Critical severity, CVSS 9.9. EPSS: 72.3% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute…
CVE-2021-21342, published 2021-03-23. Critical severity, CVSS 9.1. EPSS: 50% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type…

Latest

CVE-2021-39152, published 2021-08-23. High severity, CVSS 8.5. EPSS: 11.4% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not…
CVE-2021-39150, published 2021-08-23. High severity, CVSS 8.5. EPSS: 3.4% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not…
CVE-2021-39140, published 2021-08-23. Medium severity, CVSS 6.3. EPSS: 5.9% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on…
CVE-2021-39154, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39153, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.5% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39151, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39149, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39148, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39147, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39146, published 2021-08-23. High severity, CVSS 8.5. EPSS: 14.3% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…