Oracle Communications Messaging Server vulnerabilities

41 CVEs affecting Oracle Communications Messaging Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-23307, published 2022-01-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2021-4104, published 2021-12-14. High severity, CVSS 7.5. EPSS: 80.6% chance of exploitation in the next 30 days. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and…
CVE-2022-23305, published 2022-01-18. Critical severity, CVSS 9.8. EPSS: 66.5% chance of exploitation in the next 30 days. By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is…
CVE-2022-23302, published 2022-01-18. High severity, CVSS 8.8. EPSS: 63.6% chance of exploitation in the next 30 days. JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP…
CVE-2022-23307, published 2022-01-18. High severity, CVSS 8.8. EPSS: 54.4% chance of exploitation in the next 30 days. CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
CVE-2020-13954, published 2020-11-12. Medium severity, CVSS 6.1. EPSS: 40.9% chance of exploitation in the next 30 days. By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the…
CVE-2021-33813, published 2021-06-16. High severity, CVSS 7.5. EPSS: 19.4% chance of exploitation in the next 30 days. An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.
CVE-2020-25649, published 2020-12-03. High severity, CVSS 7.5. EPSS: 17.7% chance of exploitation in the next 30 days. A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from…
CVE-2021-36090, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.9% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…

Latest

CVE-2021-40690, published 2021-09-19. High severity, CVSS 7.5. EPSS: 7.4% chance of exploitation in the next 30 days. All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from…
CVE-2021-37714, published 2021-08-18. High severity, CVSS 7.5. EPSS: 6.7% chance of exploitation in the next 30 days. jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input,…
CVE-2021-35517, published 2021-07-13. High severity, CVSS 7.5. EPSS: 10.6% chance of exploitation in the next 30 days. When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…
CVE-2021-35516, published 2021-07-13. High severity, CVSS 7.5. EPSS: 12.4% chance of exploitation in the next 30 days. When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to…