Oracle Communications Convergence vulnerabilities

11 CVEs affecting Oracle Communications Convergence, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-21848, published 2023-01-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2019-10086, published 2019-08-20. High severity, CVSS 7.3. EPSS: 28.4% chance of exploitation in the next 30 days. In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all…
CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…
CVE-2019-17359, published 2019-10-08. High severity, CVSS 7.5. EPSS: 9.1% chance of exploitation in the next 30 days. The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
CVE-2020-28052, published 2020-12-18. High severity, CVSS 8.1. EPSS: 7.2% chance of exploitation in the next 30 days. An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect…
CVE-2018-1000613, published 2018-07-09. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code…
CVE-2019-10219, published 2019-11-08. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.…
CVE-2017-10031, published 2017-08-08. High severity, CVSS 7.2. EPSS: 1.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Convergence component of Oracle Communications Applications (subcomponent: Mail Proxy (dojo)). Supported versions that are affected are 3.0 and 3.0.1.…
CVE-2018-2936, published 2018-07-18. Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Messaging Server component of Oracle Communications Applications (subcomponent: Web Client). The supported version that is affected is 3.x. Easily…
CVE-2023-21848, published 2023-01-18. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Admin Configuration). The supported version that is affected is 3.0.3.1.0. Easily…

Latest

CVE-2022-21338, published 2022-01-19. Medium severity, CVSS 4.6. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: General Framework). The supported version that is affected is 3.0.2.2.0. Easily…