Oracle Communications Analytics vulnerabilities

11 CVEs affecting Oracle Communications Analytics, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-11023, published 2020-04-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability, published 2020-04-29. Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation…
CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2016-8610, published 2017-11-13. High severity, CVSS 7.5. EPSS: 39.7% chance of exploitation in the next 30 days. A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote…
CVE-2019-10247, published 2019-04-22. Medium severity, CVSS 5.3. EPSS: 5.9% chance of exploitation in the next 30 days. In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified…
CVE-2019-10246, published 2019-04-22. Medium severity, CVSS 5.3. EPSS: 4.1% chance of exploitation in the next 30 days. In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it…
CVE-2018-11058, published 2018-09-14. Critical severity, CVSS 9.8. EPSS: 4% chance of exploitation in the next 30 days. RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5.3 (in 4.0.x) contain a Buffer Over-Read…
CVE-2018-11054, published 2018-08-31. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability. A remote attacker could use maliciously constructed ASN.1 data to potentially cause a Denial Of Service.
CVE-2018-15769, published 2018-11-16. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key management error issue. A malicious TLS server could potentially…
CVE-2018-11056, published 2018-08-31. Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days. RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled Resource Consumption ('Resource…
CVE-2018-11057, published 2018-08-31. Medium severity, CVSS 5.9. EPSS: 1.7% chance of exploitation in the next 30 days. RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher…

Latest

CVE-2018-11055, published 2018-08-31. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release ('Heap Inspection') vulnerability.…