Oracle Communications Application Session Controller vulnerabilities

20 CVEs affecting Oracle Communications Application Session Controller, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-2351, published 2021-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability, published 2017-04-06. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 90.3% chance of exploitation in the next 30 days. Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an…
CVE-2020-11022, published 2020-04-29. Medium severity, CVSS 6.1. EPSS: 99.2% chance of exploitation in the next 30 days. In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may…
CVE-2018-11784, published 2018-10-04. Medium severity, CVSS 4.3. EPSS: 97.7% chance of exploitation in the next 30 days. When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested…
CVE-2015-0235, published 2015-01-28. High severity, CVSS 10.0. EPSS: 94.6% chance of exploitation in the next 30 days. Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors…
CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2013-2566, published 2013-03-15. Medium severity, CVSS 5.9. EPSS: 84.4% chance of exploitation in the next 30 days. The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis…
CVE-2015-2808, published 2015-04-01. Low severity, CVSS 3.7. EPSS: 73.9% chance of exploitation in the next 30 days. The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to…
CVE-2017-3730, published 2017-05-04. High severity, CVSS 7.5. EPSS: 55.3% chance of exploitation in the next 30 days. In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a…
CVE-2020-11987, published 2021-02-24. High severity, CVSS 8.2. EPSS: 13.3% chance of exploitation in the next 30 days. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this…
CVE-2019-17566, published 2020-11-12. High severity, CVSS 7.5. EPSS: 10.9% chance of exploitation in the next 30 days. Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this…

Latest

CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…
CVE-2020-28052, published 2020-12-18. High severity, CVSS 8.1. EPSS: 7.2% chance of exploitation in the next 30 days. An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect…
CVE-2020-27216, published 2020-10-23. High severity, CVSS 7.0. EPSS: 4.4% chance of exploitation in the next 30 days. In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between…
CVE-2020-10683, published 2020-05-01. Critical severity, CVSS 9.8. EPSS: 7.3% chance of exploitation in the next 30 days. dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing…
CVE-2020-9488, published 2020-04-27. Low severity, CVSS 3.7. EPSS: 8.2% chance of exploitation in the next 30 days. Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log…
CVE-2020-5258, published 2020-03-10. High severity, CVSS 7.7. EPSS: 4% chance of exploitation in the next 30 days. In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language…