Oracle Communications Brm - Elastic Charging Engine vulnerabilities

14 CVEs affecting Oracle Communications Brm - Elastic Charging Engine, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-43859, published 2022-02-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44832, published 2021-12-28. Medium severity, CVSS 6.6. EPSS: 97.9% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender…
CVE-2021-29505, published 2021-05-28. High severity, CVSS 8.8. EPSS: 77.2% chance of exploitation in the next 30 days. XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of…
CVE-2021-21342, published 2021-03-23. Critical severity, CVSS 9.1. EPSS: 50% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type…
CVE-2018-15756, published 2018-10-18. High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days. Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving…
CVE-2020-11612, published 2020-04-07. High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days. The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty…
CVE-2021-43859, published 2022-02-01. High severity, CVSS 7.5. EPSS: 7.9% chance of exploitation in the next 30 days. XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU…
CVE-2021-37137, published 2021-10-19. High severity, CVSS 7.5. EPSS: 6.6% chance of exploitation in the next 30 days. The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was…
CVE-2021-38153, published 2021-09-22. Medium severity, CVSS 5.9. EPSS: 6.2% chance of exploitation in the next 30 days. Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be…
CVE-2021-37136, published 2021-10-19. High severity, CVSS 7.5. EPSS: 5.9% chance of exploitation in the next 30 days. The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of…
CVE-2021-21409, published 2021-03-30. Medium severity, CVSS 5.9. EPSS: 4.9% chance of exploitation in the next 30 days. Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty…

Latest

CVE-2021-22118, published 2021-05-27. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory,…
CVE-2021-21290, published 2021-02-08. Medium severity, CVSS 5.5. EPSS: 1.8% chance of exploitation in the next 30 days. Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version…