Oracle Communications Order And Service Management vulnerabilities

13 CVEs affecting Oracle Communications Order And Service Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-30729, published 2025-04-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-0227, published 2019-05-01. High severity, CVSS 7.5. EPSS: 91.9% chance of exploitation in the next 30 days. A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x…
CVE-2018-8032, published 2018-08-02. Medium severity, CVSS 6.1. EPSS: 10.6% chance of exploitation in the next 30 days. Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…
CVE-2021-36374, published 2021-07-14. Medium severity, CVSS 5.5. EPSS: 2.6% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs.…
CVE-2021-36373, published 2021-07-14. Medium severity, CVSS 5.5. EPSS: 2.5% chance of exploitation in the next 30 days. When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used…
CVE-2020-1945, published 2020-05-14. Medium severity, CVSS 6.3. EPSS: 1.8% chance of exploitation in the next 30 days. Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The…
CVE-2018-2756, published 2018-04-19. Medium severity, CVSS 6.3. EPSS: 1.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Order and Service Management component of Oracle Communications Applications (subcomponent: WebUI). Supported versions that are affected are 7.2.4.3.0,…
CVE-2018-2567, published 2018-01-18. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Order and Service Management component of Oracle Communications Applications (subcomponent: Portal). Supported versions that are affected are 7.2.4.1.x,…
CVE-2023-22088, published 2023-10-17. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: User Management). Supported versions that are affected are 7.4.0 and…
CVE-2025-21554, published 2025-01-21. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and…

Latest

CVE-2025-30729, published 2025-04-15. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and…
CVE-2025-21544, published 2025-01-21. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and…
CVE-2025-21542, published 2025-01-21. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and…