Oracle Communications Operations Monitor vulnerabilities

45 CVEs affecting Oracle Communications Operations Monitor, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-24736, published 2022-04-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability, published 2020-04-29. Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation…
CVE-2021-44790, published 2021-12-20. Critical severity, CVSS 9.8. EPSS: 96.8% chance of exploitation in the next 30 days. A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the…
CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2021-44224, published 2021-12-20. High severity, CVSS 8.2. EPSS: 82.3% chance of exploitation in the next 30 days. A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can…
CVE-2018-11218, published 2018-06-17. Critical severity, CVSS 9.8. EPSS: 59% chance of exploitation in the next 30 days. Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
CVE-2017-3730, published 2017-05-04. High severity, CVSS 7.5. EPSS: 55.3% chance of exploitation in the next 30 days. In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a…
CVE-2021-23017, published 2021-06-01. High severity, CVSS 7.7. EPSS: 53.5% chance of exploitation in the next 30 days. A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process…
CVE-2021-41184, published 2021-10-26. Medium severity, CVSS 6.1. EPSS: 40.8% chance of exploitation in the next 30 days. jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code.…
CVE-2021-41182, published 2021-10-26. Medium severity, CVSS 6.1. EPSS: 39.4% chance of exploitation in the next 30 days. jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted…
CVE-2019-10192, published 2019-07-11. High severity, CVSS 7.2. EPSS: 26% chance of exploitation in the next 30 days. A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using…

Latest

CVE-2022-24736, published 2022-04-27. Medium severity, CVSS 5.5. EPSS: 1.5% chance of exploitation in the next 30 days. Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will…
CVE-2022-24735, published 2022-04-27. High severity, CVSS 7.8. EPSS: 2.3% chance of exploitation in the next 30 days. Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua…
CVE-2022-21403, published 2022-01-19. Medium severity, CVSS 6.6. EPSS: 0.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0.…
CVE-2022-21402, published 2022-01-19. Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0.…
CVE-2022-21401, published 2022-01-19. Medium severity, CVSS 6.6. EPSS: 0.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0.…
CVE-2022-21400, published 2022-01-19. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0.…
CVE-2022-21399, published 2022-01-19. Medium severity, CVSS 6.6. EPSS: 0.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0.…
CVE-2022-21398, published 2022-01-19. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0.…
CVE-2022-21397, published 2022-01-19. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0.…
CVE-2022-21396, published 2022-01-19. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0.…