Oracle Communications Policy Management vulnerabilities

50 CVEs affecting Oracle Communications Policy Management, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22965, published 2022-04-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-11776: Apache Struts Remote Code Execution Vulnerability, published 2018-08-22. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then:…
CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability, published 2022-04-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-04. EPSS: 99.6% chance of exploitation in the next 30 days. A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR…
CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability, published 2020-12-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 95.9% chance of exploitation in the next 30 days. Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
CVE-2019-0230, published 2020-09-14. Critical severity, CVSS 9.8. EPSS: 96.9% chance of exploitation in the next 30 days. Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
CVE-2015-0235, published 2015-01-28. High severity, CVSS 10.0. EPSS: 94.6% chance of exploitation in the next 30 days. Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors…
CVE-2020-5398, published 2020-01-17. High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days. In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it…
CVE-2020-26217, published 2020-11-16. High severity, CVSS 8.8. EPSS: 85% chance of exploitation in the next 30 days. XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.…
CVE-2021-21351, published 2021-03-23. Critical severity, CVSS 9.1. EPSS: 82.1% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a…
CVE-2021-21346, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 76.4% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code…
CVE-2021-21344, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 76% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code…

Latest

CVE-2021-43859, published 2022-02-01. High severity, CVSS 7.5. EPSS: 7.9% chance of exploitation in the next 30 days. XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU…
CVE-2021-23450, published 2021-12-17. Critical severity, CVSS 9.8. EPSS: 30.4% chance of exploitation in the next 30 days. All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
CVE-2021-43527, published 2021-12-08. Critical severity, CVSS 9.8. EPSS: 17.6% chance of exploitation in the next 30 days. NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling…
CVE-2021-33037, published 2021-07-12. Medium severity, CVSS 5.3. EPSS: 74.7% chance of exploitation in the next 30 days. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request…
CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…
CVE-2021-21350, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 15.2% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by…
CVE-2021-21349, published 2021-03-23. High severity, CVSS 8.6. EPSS: 46.8% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal…
CVE-2021-21348, published 2021-03-23. High severity, CVSS 7.5. EPSS: 13.8% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes…