Oracle Communications Design Studio vulnerabilities

15 CVEs affecting Oracle Communications Design Studio, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22969, published 2022-04-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-0227, published 2019-05-01. High severity, CVSS 7.5. EPSS: 91.9% chance of exploitation in the next 30 days. A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x…
CVE-2019-10086, published 2019-08-20. High severity, CVSS 7.3. EPSS: 28.4% chance of exploitation in the next 30 days. In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all…
CVE-2021-23337, published 2021-02-15. High severity, CVSS 7.2. EPSS: 21.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2020-5421, published 2020-09-19. Medium severity, CVSS 6.5. EPSS: 11.6% chance of exploitation in the next 30 days. In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed…
CVE-2018-8032, published 2018-08-02. Medium severity, CVSS 6.1. EPSS: 10.6% chance of exploitation in the next 30 days. Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…
CVE-2020-11612, published 2020-04-07. High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days. The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty…
CVE-2020-28500, published 2021-02-15. Medium severity, CVSS 5.3. EPSS: 7.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVE-2021-21409, published 2021-03-30. Medium severity, CVSS 5.9. EPSS: 4.9% chance of exploitation in the next 30 days. Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty…
CVE-2019-16168, published 2019-09-09. Medium severity, CVSS 6.5. EPSS: 4.3% chance of exploitation in the next 30 days. In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the…

Latest

CVE-2022-22969, published 2022-04-21. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. <Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization…
CVE-2021-43797, published 2021-12-09. Medium severity, CVSS 6.5. EPSS: 2.9% chance of exploitation in the next 30 days. Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips…
CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2021-21290, published 2021-02-08. Medium severity, CVSS 5.5. EPSS: 1.8% chance of exploitation in the next 30 days. Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version…